CVE-2026-116150 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Attackers can submit crafted images for FPX encoding to leak memory repeatedly, causing resource exhaustion and denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The identified vulnerability resides within the Fast Picture Exchange (FPX) encoder component of ImageMagick prior to version 7.1.2-33. This specific flaw is classified as a memory leak, which corresponds to CWE-401 in the Common Weakness Enumeration standard. The root cause lies in improper management of dynamic memory allocation during the processing and encoding of FPX image files. When ImageMagick processes an input file intended for conversion or manipulation using the FPX delegate, it allocates heap memory to handle various data structures associated with the image metadata and pixel data. In vulnerable versions, certain code paths within the encoder fail to properly release this allocated memory after the operation is complete or when specific error conditions are encountered during parsing.
The technical mechanism of exploitation involves an attacker submitting a specially crafted FPX file that triggers these unmanaged allocation pathways. The crafted input typically exploits ambiguities in how the parser handles malformed headers, truncated data streams, or specifically structured metadata blocks within the FPX container format. As ImageMagick processes this maliciously constructed image through its encoding pipeline, it repeatedly allocates memory without corresponding deallocation calls. This behavior results in a progressive and unbounded increase in the process's resident set size over time. The vulnerability is particularly dangerous because it can be triggered remotely if ImageMagick is deployed as part of a web service or application that accepts user-uploaded images for processing, such as thumbnail generation services or document conversion platforms.
The operational impact of this memory leak is primarily resource exhaustion leading to denial of service conditions. As the vulnerable process continues to consume available system RAM without releasing it, performance degrades significantly due to increased swapping and cache thrashing. Eventually, the operating system's out-of-memory killer may terminate the ImageMagick process or related services, causing a disruption in availability for legitimate users. In environments where ImageMagick runs with elevated privileges or handles sensitive data, this denial of service could also serve as a precursor to more complex attacks by destabilizing the host environment. The attack does not require code execution on the target system but relies solely on the ability to supply malicious input files to the processing engine.
This vulnerability aligns with ATT&CK technique T1496 Resource Hijacking, specifically sub-technique T1496.002 Denial of Service via resource exhaustion. The lack of proper memory cleanup represents a failure in robustness and error handling principles outlined in secure coding standards. To mitigate this risk, organizations must immediately upgrade ImageMagick to version 7.1.2-33 or later, where the FPX encoder has been patched to ensure all allocated buffers are correctly freed upon completion of encoding tasks regardless of success or failure states. Additionally, defensive measures should include implementing strict input validation and size limits on uploaded images before they reach the ImageMagick processing pipeline. Deploying web application firewalls with rules capable of detecting anomalous memory usage patterns in backend services can also provide an additional layer of defense against exploitation attempts targeting this specific weakness.