---
id: "CVE-2026-116158"
kind: "vulnerability"
aliases: ["CVE-2026-116158"]
title: "ImageMagick: failed compare operations leak memory, enabling denial of service"
severity: "low"
cvss: 2.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["image-processing", "imagemagick", "package", "self-hosted"]
not_affected_if: ["compare-command-unused", "trusted-inputs-only"]
published_at: "2026-10-25T14:16:54+00:00"
first_seen_at: "2026-10-25T14:41:22+00:00"
updated_at: "2026-10-25T14:44:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116158", "first_seen_at": "2026-10-25T14:41:22+00:00"}]
---

# ImageMagick: failed compare operations leak memory, enabling denial of service

ImageMagick before 7.1.2-33 does not clean up memory when a magick compare operation fails. An attacker who supplies inputs that trigger repeated failed compares can exhaust memory and crash the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `magick -version` to read the installed ImageMagick version
- Check whether any service runs `magick compare` on user-supplied images

## Fix

- Upgrade ImageMagick to `7.1.2-33` or later
- unknown for a mitigation other than upgrading

## Timeline

- 2026-10-25T14:41:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116158

## From the sources

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_