VULNERABILITY INTELLIGENCE

CVE-2026-116156

CVSS score4.8 MEDIUM
EPSS probability0.11%
CISA KEVNot currently listed
Published2026-10-25
Last modified2026-10-26
CVSS vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service.

Weakness classification

  • CWE-401: Missing Release of Memory after Effective Lifetime

Primary references