CVE-2026-116151 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified within ImageMagick versions prior to 6.9.13-58 and 7.x prior to 7.1.2-33 represents a critical flaw in the JNG image encoder component, specifically manifesting as an uncontrolled memory allocation issue. This defect occurs when the software processes specially crafted input images that are intended for encoding into the JPEG Network Graphics format. The core technical failure lies in the internal logic of the encoder, which allocates heap memory to handle various aspects of the image data but fails to properly deallocate or release this memory upon completion of the processing task. This oversight results in a classic resource leak where allocated blocks remain occupied even after they are no longer needed by the application for that specific operation. Over time, as more such crafted images are processed, the cumulative effect is a steady and unbounded increase in the memory footprint of the ImageMagick process or any service utilizing it.
From an operational perspective, this vulnerability poses a significant risk to system stability and availability through resource exhaustion. An attacker who can trigger the encoding of maliciously constructed JNG files can systematically consume available server memory without bound. This leads to a state where the application becomes increasingly sluggish as it competes for diminishing resources, eventually resulting in a denial of service condition. In environments where ImageMagick is used within web applications or automated pipelines that process user-uploaded content, this flaw allows remote attackers to degrade performance or crash services simply by submitting specific image files. The impact is particularly severe in high-throughput scenarios where the memory leak accumulates rapidly, potentially causing out-of-memory errors that terminate processes and disrupt service availability for legitimate users.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-401, which describes a missing release of memory after effective usage. It also relates to CWE-772, referring to Missing Release of Resource after Effective Lifetime, as the allocated resources are not freed when they should be. In terms of adversary tactics and techniques, this flaw can be leveraged within MITRE ATT&CK framework technique T1496, specifically under resource hijacking for denial-of-service purposes. Attackers may use such memory exhaustion vectors to disrupt critical infrastructure or application services without needing to exploit more complex code execution flaws, making it a potent tool for causing operational disruption in systems that rely on robust image processing capabilities.
Mitigation strategies primarily involve upgrading ImageMagick to version 6.9.13-58 or later, and for the major seven series, updating to version 7.1.2-33 or newer where this memory leak has been addressed by the development team through proper resource management fixes in the JNG encoder logic. For organizations unable to immediately patch their systems due to compatibility constraints, implementing strict input validation is recommended as a compensating control. This includes restricting file uploads to trusted sources only and validating image formats before processing. Additionally, deploying runtime protection mechanisms such as memory limits for ImageMagick processes can help contain the impact of an attack by preventing any single process from consuming excessive system resources. Regular monitoring of application resource usage patterns can also aid in early detection of abnormal memory consumption indicative of exploitation attempts.