{"id":"CVE-2026-116158","kind":"vulnerability","aliases":["CVE-2026-116158"],"related":[],"title":"ImageMagick: failed compare operations leak memory, enabling denial of service","description":"ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.","summary":"ImageMagick before 7.1.2-33 does not clean up memory when a magick compare operation fails. An attacker who supplies inputs that trigger repeated failed compares can exhaust memory and crash the service.","severity":"low","cvss":2.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagemagick","package","self-hosted"],"not_affected_if":["compare-command-unused","trusted-inputs-only"],"how_to_check":"- `magick -version` to read the installed ImageMagick version\n- Check whether any service runs `magick compare` on user-supplied images","fix":"- Upgrade ImageMagick to `7.1.2-33` or later\n- unknown for a mitigation other than upgrading","status":"open","published_at":"2026-10-25T14:16:54+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:44:17+00:00","updated_at":"2026-10-25T14:44:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:44:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick to `7.1.2-33` or later\n- unknown for a mitigation other than upgrading","reach":"unknown","title":"ImageMagick: failed compare operations leak memory, enabling denial of service","impact":"low","summary":"ImageMagick before 7.1.2-33 does not clean up memory when a magick compare operation fails. An attacker who supplies inputs that trigger repeated failed compares can exhaust memory and crash the service.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","image-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Repeated failed compares exhaust memory and crash the service","analyst_note":"","how_to_check":"- `magick -version` to read the installed ImageMagick version\n- Check whether any service runs `magick compare` on user-supplied images","needs_analyst":false,"not_affected_if":["trusted-inputs-only","compare-command-unused"],"who_is_affected":"Systems running ImageMagick before `7.1.2-33` that call the `magick compare` command on files an outside party can supply, such as image-comparison or thumbnail-checking services. Systems that run ImageMagick only on trusted inputs, or do not use the compare command, face little exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000574,"input_tokens":3309,"output_tokens":487,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116158':13A,16A '-2026':12A,15A '-33':28B,60C '7.1.2':27B,59C 'attack':41B,79C 'caus':71C,93C 'clean':31B 'cleanup':74C 'command':70C 'compar':3A,37B,49B,69C,87C 'contain':61C 'crash':54B 'cve':11A,14A 'denial':8A,94C 'enabl':7A 'exhaust':51B,90C 'fail':2A,39B,48B,78C,86C 'host':24B 'imag':18B 'image-process':17B 'imagemagick':1A,20B,25B,57C 'input':44B,82C 'leak':5A,64C 'magick':36B,68C 'memori':6A,33B,52B,63C,91C 'miss':73C 'oper':4A,38B,77C,88C 'packag':21B 'process':19B 'repeat':47B,85C 'self':23B 'self-host':22B 'servic':10A,56B,96C 'suppli':43B,81C 'trigger':46B,84C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Systems running ImageMagick before `7.1.2-33` that call the `magick compare` command on files an outside party can supply, such as image-comparison or thumbnail-checking services. Systems that run ImageMagick only on trusted inputs, or do not use the compare command, face little exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116158","severity":null,"published_at":"2026-10-25T14:16:54+00:00","modified_at":"2026-10-25T14:16:54+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}