CVE-2026-116143 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than permitted, potentially exhausting resources.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified involves a critical flaw within the image processing library ImageMagick, specifically affecting versions prior to 6.9.13-58 and version 7.x prior to 7.1.2-33. This issue centers on a policy bypass mechanism located in the decoders for PostScript (PS), Portable Document Format (PDF), and XPS file formats. ImageMagick utilizes a security policy system designed to restrict certain operations that could be abused by malicious actors, such as limiting the number of images or scenes processed from a single input document. The core technical flaw lies in how these specific decoders handle scene selection arguments supplied during parsing. Instead of strictly enforcing the configured list length limits defined in the security policy configuration file, the affected code paths allow an attacker to supply crafted arguments that circumvent these restrictions. This bypass enables the application to process a significantly higher number of scenes than intended by the administrator's security posture.
From a technical perspective, this vulnerability represents a failure in input validation and enforcement logic within the decoder modules. When ImageMagick parses complex document formats like PDF or PS, it often breaks down the content into individual frames or pages referred to as scenes. The security policy is meant to cap this number to prevent denial of service attacks where an attacker provides a file with thousands of embedded images designed to exhaust system resources such as memory and CPU cycles during rendering. By exploiting the bypass in scene selection arguments, attackers can effectively ignore these caps. This allows for the processing of an unbounded or excessively large number of scenes from a single maliciously crafted document. The flaw is particularly insidious because it relies on specific argument structures that may not trigger standard validation checks, allowing the operation to proceed under the guise of legitimate image manipulation tasks while silently violating resource limits.
The operational impact of this vulnerability is primarily centered around denial of service and potential resource exhaustion. If an ImageMagick instance is configured to process untrusted input from external sources without adequate sandboxing or additional controls, feeding it a specially crafted PS, PDF, or XPS file can lead to severe performance degradation or complete system failure. The application may consume excessive amounts of RAM as it attempts to decode and render the multitude of scenes, potentially leading to out-of-memory errors that crash the service. In web applications or automated processing pipelines where ImageMagick is used for image conversion or thumbnail generation, this could result in service unavailability for legitimate users. Furthermore, while the primary impact described is resource exhaustion, such bypasses can sometimes serve as a precursor to more severe issues if they allow access to other restricted functionalities that are gated by similar policy checks.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-755: Improper Handling of Exceptional Conditions, as the software fails to properly validate or enforce limits on input parameters derived from external files. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1496 Resource Hijacking, where an attacker uses computing resources for their own benefit by causing a denial of service through resource exhaustion. To mitigate this risk, organizations must immediately upgrade ImageMagick to version 6.9.13-58 or later, and version 7.1.2-33 or later, which contain the necessary patches to enforce policy limits correctly in these decoders. Additionally, administrators should review their security policy configurations to ensure that resource limits are set appropriately for their use case. Implementing additional controls such as rate limiting, input size restrictions at the network level, and running ImageMagick processes with minimal privileges can further reduce the blast radius of any potential exploitation attempts until patches are fully deployed across all affected systems.