Live › vulnerability › CVE-2026-116158
Go to dashboardImageMagick before 7.1.2-33 does not clean up memory when a magick compare operation fails. An attacker who supplies inputs that trigger repeated failed compares can exhaust memory and crash the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Systems running ImageMagick before that call the command on files an outside party can supply, such as image-comparison or thumbnail-checking services. Systems that run ImageMagick only on trusted inputs, or do not use the compare command, face little exposure.
7.1.2-33magick compareNo product ranges from the sources yet.
magick -version to read the installed ImageMagick versionmagick compare on user-supplied images7.1.2-33 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116158")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.