---
id: "CVE-2026-116157"
kind: "vulnerability"
aliases: ["CVE-2026-116157"]
title: "ImageMagick PerlMagick: memory leak in image property reads enables denial of service"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["imagemagick", "package", "perl", "perlmagick", "self-hosted"]
not_affected_if: ["command-line-only", "no-perlmagick", "no-untrusted-image-input"]
published_at: "2026-10-25T14:16:54+00:00"
first_seen_at: "2026-10-25T14:41:22+00:00"
updated_at: "2026-10-25T14:43:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116157", "first_seen_at": "2026-10-25T14:41:22+00:00"}]
---

# ImageMagick PerlMagick: memory leak in image property reads enables denial of service

ImageMagick versions before 7.1.2-33 leak memory in PerlMagick when image property values returned by reads are never freed. An attacker who can make the application repeatedly read image properties can exhaust memory and crash the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `magick -version` and check whether the version is earlier than `7.1.2-33`.
- Check whether the application loads the PerlMagick module (`Image::Magick`) with `perl -MImage::Magick -e 'print $Image::Magick::VERSION'`.

## Fix

- Upgrade ImageMagick to `7.1.2-33` or later.
- Restart long-running PerlMagick processes after upgrading so the fixed library is loaded.

## Timeline

- 2026-10-25T14:41:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116157

## From the sources

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_