CVE-2026-116156

4.8 medium

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service.

CVSS 4.0: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE: CWE-401
Published: 2026-10-25
Modified: 2026-10-25
Record from: the NVD, synced 2026-10-25

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7r5g-p7ff-jgcp
https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-via-set-profile-option

Check your stack JSON