CPANSA-ImageMagick-2026-116157: ImageMagick vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-10-25T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-10-25T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 3.3 | Severity | Low |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.
Vulnerabilities
CVE-2026-116157
Vulnerability DescriptionImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.
| Weakness | CWE-401 : Missing Release of Memory after Effective Lifetime |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| ImageMagick less than 7.1.2-33 |
|
Fixed
- ImageMagick greater than or equal 7.1.2-33
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-ImageMagick-2026-116157 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-imagemagick-2026-116157.json - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3 external
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3 - https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-perlmagick-property-reading external
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-perlmagick-property-reading - CVE-2026-116157 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-116157
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Sun Oct 25 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/