CVE-2026-116147 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process and causes a denial of service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in ImageMagick versions prior to 6.9.13-58 and 7.x before 7.1.2-33 represents a critical memory management flaw within the DJVU image decoder component. This issue stems from a failure to validate the return value of a dynamic memory allocation function, specifically resulting in a null pointer dereference when the underlying system is unable to fulfill a request for heap space. In software development, it is standard practice to verify that pointers returned by functions such as malloc or calloc are not NULL before attempting to access or modify data at those addresses. The absence of this check creates a predictable execution path where an application may proceed with operations on invalid memory references if the operating system returns a null pointer due to resource exhaustion or other allocation failures.
From a technical perspective, this flaw is classified under CWE-476, which denotes NULL Pointer Dereference. This category of vulnerabilities occurs when software attempts to use a pointer that has not been properly initialized or validated, leading to undefined behavior. In the context of ImageMagick, the DJVU decoder processes complex image formats that require significant memory resources for parsing headers and decoding pixel data. When an attacker supplies a crafted DJVU file designed to trigger high memory consumption during processing, they increase the likelihood of allocation failure. If the environment is under stress or if specific constraints are met, the allocation fails, returning NULL. The subsequent code execution attempts to write to or read from this null address, causing immediate segmentation faults and process termination.
The operational impact of this vulnerability is primarily a denial of service against systems relying on ImageMagick for image processing tasks. Since many web applications, content management systems, and automated pipelines utilize ImageMagick as a backend library to handle user-uploaded images or batch conversions, the ability to crash the application through malicious input poses a significant risk to availability. An attacker does not necessarily need authentication to exploit this flaw; simply providing a specially crafted DJVU file is sufficient to trigger the condition if the processing environment experiences memory pressure. This makes it particularly dangerous in shared hosting environments or cloud-based image services where resource limits are enforced, as even minor allocation failures can be weaponized by an adversary to disrupt service for legitimate users.
This vulnerability aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-technique of Resource Exhaustion via Overflow or Injection. By exploiting memory allocation weaknesses, attackers aim to degrade system performance or cause complete outages without necessarily gaining unauthorized access to data or executing arbitrary code. While this specific instance does not appear to lead directly to remote code execution due to the nature of null pointer dereferences in modern operating systems with address space layout randomization and stack canaries, it remains a severe availability risk that must be addressed promptly.
Mitigation strategies for this vulnerability involve upgrading ImageMagick to version 6.9.13-58 or later, as well as any 7.x release prior to 7.1.2-33 being affected, ensuring the patch is applied immediately. For organizations unable to upgrade instantly, implementing strict input validation and resource limits on image processing services can help mitigate risk. Configuring memory quotas for worker processes handling untrusted images ensures that a single malicious request cannot exhaust system resources entirely. Additionally, deploying web application firewalls with rules capable of detecting anomalous file sizes or malformed headers in DJVU uploads may provide an additional layer of defense against exploitation attempts until the software is fully patched.