---
id: "CVE-2026-116159"
kind: "vulnerability"
aliases: ["CVE-2026-116159"]
title: "ImageMagick: -cdl option leaks memory, exhausting server resources over time"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["image-processing", "imagemagick", "package", "self-hosted"]
not_affected_if: ["default-config", "trusted-input-only"]
published_at: "2026-10-25T14:16:54+00:00"
first_seen_at: "2026-10-25T14:41:22+00:00"
updated_at: "2026-10-25T14:43:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116159", "first_seen_at": "2026-10-25T14:41:22+00:00"}]
---

# ImageMagick: -cdl option leaks memory, exhausting server resources over time

ImageMagick leaks memory when the -cdl (color decision list) option runs, because allocated memory is never freed. An attacker who can supply input that triggers the option can repeatedly leak memory and degrade availability through resource exhaustion.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `magick -version` (or `convert -version`) and compare the reported version with the fixed releases below.
- Check whether any service passes user-supplied input to ImageMagick with the -cdl option.

## Fix

- Upgrade ImageMagick 6.x to `6.9.13-58` or later.
- Upgrade ImageMagick 7.x to `7.1.2-33` or later.

## Timeline

- 2026-10-25T14:41:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116159

## From the sources

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_