CVE-2026-116141 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The identified vulnerability resides within the Universal High Dynamic Range (UHDR) decoder component of ImageMagick versions prior to 7.1.2-33. This security flaw stems from a critical ordering error in the image processing pipeline where extent checks, which are designed to enforce policy limits on resource consumption such as maximum width and height dimensions, are executed after the decoding process has already completed. In standard secure implementations of image parsers, validation of input constraints should occur prior to any intensive computational operations or memory allocations associated with parsing the file format. By deferring these checks until post-decoding, the software fails to prevent the allocation of excessive resources based on maliciously crafted inputs that specify dimensions far exceeding safe thresholds.
This architectural flaw allows attackers to bypass configured security policies by supplying specially constructed UHDR image files containing oversized dimension metadata. When ImageMagick processes such a file, it proceeds to decode the entire image data into memory without first verifying if the resulting width and height would violate established limits. This behavior leads directly to excessive resource consumption as the system attempts to allocate memory for an impossibly large bitmap or buffer structure. The impact of this vulnerability is primarily denial of service, where the processing of a single crafted file can exhaust available system memory or CPU resources, potentially causing the application to crash or become unresponsive. In environments where ImageMagick processes user-uploaded images without strict pre-validation, this could be exploited for remote resource exhaustion attacks against web servers or image processing pipelines.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write if the decoding process attempts to write data beyond allocated buffers due to incorrect dimension calculations derived from the oversized metadata. It also relates to CWE-400 Uncontrolled Resource Consumption as the primary consequence is the depletion of system resources through excessive memory allocation triggered by unvalidated input dimensions. In terms of adversary tactics, this technique corresponds to ATT&CK T1496 Resource Hijacking where attackers leverage compromised or vulnerable systems for computational resource consumption, although in this specific context it manifests more directly as a denial-of-service vector rather than cryptomining or other persistent hijacking activities.
To mitigate this vulnerability, organizations must upgrade ImageMagick to version 7.1.2-33 or later where the decoding logic has been corrected to enforce extent checks before processing begins. Additionally, administrators should review and tighten policy configurations in the magick.policy.xml file to restrict maximum dimensions and memory usage limits for UHDR formats specifically. Implementing input validation at the application layer prior to invoking ImageMagick functions provides an additional defense-in-depth measure. Security teams should also monitor system logs for signs of excessive memory allocation or process termination related to image processing services, as these may indicate attempted exploitation of this flaw in unpatched environments.