Live › vulnerability › CVE-2026-116159
Go to dashboardImageMagick leaks memory when the -cdl (color decision list) option runs, because allocated memory is never freed. An attacker who can supply input that triggers the option can repeatedly leak memory and degrade availability through resource exhaustion.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Systems that run ImageMagick below 6.9.13-58 or 7.x below 7.1.2-33 and let untrusted input reach the -cdl option, such as image upload or conversion services. Installations that only process trusted images or never use -cdl are unlikely to be meaningfully exposed.
No product ranges from the sources yet.
magick -version (or convert -version) and compare the reported version with the fixed releases below.6.9.13-58 or later.7.1.2-33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.
This page as .md · .json · in your agent: get_signal("CVE-2026-116159")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.