CVE-2026-116154 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in ImageMagick versions prior to 6.9.13-58 and 7.x before 7.1.2-33 represents a critical resource management flaw within the application's XML parsing subsystem. This issue is classified under CWE-401, which denotes a missing release of memory after effective usage. The core technical defect lies in the handling of deeply nested structures during the processing of XML documents. When ImageMagick parses an input file containing hierarchical data, it allocates stack or heap memory to track the nesting depth and associated metadata for each level. However, the implementation fails to properly deallocate this reserved memory when the parser encounters a predefined maximum nesting limit. Instead of terminating the operation cleanly and freeing all allocated resources, the application leaves these memory blocks in an unreleased state, leading to a progressive accumulation of unused allocations over time or within a single processing session.
From an operational perspective, this flaw enables attackers to execute denial-of-service attacks with significant efficiency. By constructing crafted XML files that exploit the nesting depth limit without triggering immediate termination, adversaries can force the ImageMagick process to consume increasing amounts of system memory. As the parser continues to allocate resources for each nested element until it hits the hard limit and fails to clean up, the host system's available RAM is rapidly depleted. This exhaustion prevents legitimate processes from functioning correctly, potentially causing system instability, application crashes, or a complete halt in service availability depending on the deployment context. The impact is particularly severe in environments where ImageMagick is used as part of a web-facing pipeline, such as image processing services for websites or APIs, allowing remote attackers to trigger the condition without local access.
This vulnerability aligns with ATT&CK technique T1496, Resource Hijacking, specifically under the sub-technique of resource consumption via denial-of-service methods. The attack vector relies on the application's inability to manage its internal state correctly when faced with malformed or excessively complex input data. It highlights a common pitfall in C-based libraries where manual memory management is required but error handling paths are not fully comprehensive regarding cleanup routines. The lack of proper resource release mechanisms means that even if the parsing operation eventually stops due to hitting the depth limit, the side effect of leaked memory persists until the process terminates or the system runs out of resources entirely.
Mitigation strategies primarily involve upgrading ImageMagick to version 6.9.13-58 or later for the legacy branch and version 7.1.2-33 or later for the current major release line, where these memory management issues have been addressed by developers through improved cleanup routines in the XML parser. In addition to software updates, organizations should implement input validation controls at the network perimeter using web application firewalls or custom middleware that restricts the complexity and depth of incoming XML payloads before they reach ImageMagick. Limiting file sizes and enforcing strict schema validations can further reduce the attack surface by preventing deeply nested structures from being processed in the first place. Regular security audits focusing on resource management practices within image processing libraries are also recommended to identify similar patterns in other components that may be susceptible to memory exhaustion attacks.