{"id":"CVE-2026-116159","kind":"vulnerability","aliases":["CVE-2026-116159"],"related":[],"title":"ImageMagick: -cdl option leaks memory, exhausting server resources over time","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.","summary":"ImageMagick leaks memory when the -cdl (color decision list) option runs, because allocated memory is never freed. An attacker who can supply input that triggers the option can repeatedly leak memory and degrade availability through resource exhaustion.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagemagick","package","self-hosted"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- Run `magick -version` (or `convert -version`) and compare the reported version with the fixed releases below.\n- Check whether any service passes user-supplied input to ImageMagick with the -cdl option.","fix":"- Upgrade ImageMagick 6.x to `6.9.13-58` or later.\n- Upgrade ImageMagick 7.x to `7.1.2-33` or later.","status":"open","published_at":"2026-10-25T14:16:54+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:43:06+00:00","updated_at":"2026-10-25T14:43:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:43:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick 6.x to `6.9.13-58` or later.\n- Upgrade ImageMagick 7.x to `7.1.2-33` or later.","reach":"unknown","title":"ImageMagick: -cdl option leaks memory, exhausting server resources over time","impact":"low","summary":"ImageMagick leaks memory when the -cdl (color decision list) option runs, because allocated memory is never freed. An attacker who can supply input that triggers the option can repeatedly leak memory and degrade availability through resource exhaustion.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","image-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Repeated memory leaks exhaust server memory and cause service denial","analyst_note":"","how_to_check":"- Run `magick -version` (or `convert -version`) and compare the reported version with the fixed releases below.\n- Check whether any service passes user-supplied input to ImageMagick with the -cdl option.","needs_analyst":false,"not_affected_if":["default-config","trusted-input-only"],"who_is_affected":"Systems that run ImageMagick below 6.9.13-58 or 7.x below 7.1.2-33 and let untrusted input reach the -cdl option, such as image upload or conversion services. Installations that only process trusted images or never use -cdl are unlikely to be meaningfully exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000605,"input_tokens":3350,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116159':13A,16A '-2026':12A,15A '-33':71C '-58':65C '6.9.13':64C '7':67C '7.1.2':70C 'alloc':37B,87C 'attack':43B,95C 'avail':58B,112C 'caus':100C 'cdl':2A,30B,81C,102C 'clean':91C 'color':31B,82C 'contain':72C 'cve':11A,14A 'decis':32B,83C 'degrad':57B,111C 'exhaust':6A,61B,115C 'freed':41B 'handl':78C 'host':24B 'imag':18B 'image-process':17B 'imagemagick':1A,20B,25B,62C 'input':47B,98C 'leak':4A,26B,54B,75C,108C 'list':33B,84C 'memori':5A,27B,38B,55B,74C,88C,109C 'never':40B 'option':3A,34B,51B,85C,103C 'packag':21B 'process':19B,106C 'repeat':53B,107C 'resourc':8A,60B,114C 'run':35B 'self':23B 'self-host':22B 'server':7A 'suppli':46B,97C 'time':10A 'trigger':49B 'use':94C 'x':68C","nicknames":[],"mitigations":[],"who_affected":"Systems that run ImageMagick below 6.9.13-58 or 7.x below 7.1.2-33 and let untrusted input reach the -cdl option, such as image upload or conversion services. Installations that only process trusted images or never use -cdl are unlikely to be meaningfully exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116159","severity":null,"published_at":"2026-10-25T14:16:54+00:00","modified_at":"2026-10-25T14:16:54+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}