CVE-2026-116155 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified within ImageMagick versions prior to 6.9.13-58 and 7.x prior to 7.1.2-33 represents a significant reliability issue stemming from improper memory management during the processing of Extensible Metadata Platform, or XMP profiles embedded in image files. As a widely adopted open-source software suite for creating, editing, composing, or converting raster images, ImageMagick is frequently deployed in high-throughput environments where it processes vast quantities of user-supplied media. The specific flaw resides within the various decoders responsible for parsing these metadata structures. When an attacker supplies an image containing a crafted XMP profile designed to exploit this weakness, the application fails to correctly release allocated memory resources after processing the malformed data. This oversight results in a progressive accumulation of unreleased memory blocks with each subsequent invocation or batch process involving such maliciously constructed images.
From a technical perspective, this behavior classifies as an improper resource cleanup mechanism that leads directly to resource exhaustion. The vulnerability allows for what is technically categorized under CWE-401, which describes the failure to release allocated resources properly. In practical operational terms, if an application utilizing ImageMagick processes these crafted images repeatedly or in large volumes, the system's available memory will be steadily depleted. This depletion does not necessarily crash the software immediately but rather degrades performance over time until the operating system intervenes by terminating processes due to insufficient memory availability. Consequently, this leads to a denial of service condition where legitimate users are unable to access image processing services because the underlying infrastructure has been compromised by resource starvation.
The operational impact extends beyond simple application instability. In web-facing applications or automated pipelines that accept user uploads, an attacker can execute a low-cost denial-of-service attack with minimal computational effort on their end while imposing high costs on the target system's resources. This aligns closely with ATT&CK technique T1496, Resource Hijacking, specifically through resource exhaustion via memory leaks. The persistence of this issue across multiple major version branches indicates that the root cause is likely embedded in a shared core library or decoder module used by both legacy and current versions, suggesting that patching requires careful attention to ensure backward compatibility while fully addressing the underlying allocation logic errors.
Mitigation strategies must prioritize immediate upgrading to patched versions where these memory management flaws have been corrected. For environments unable to upgrade immediately due to dependency constraints, implementing strict input validation and sanitization of XMP metadata before it reaches ImageMagick decoders can provide a layer of defense in depth. Additionally, deploying resource limits such as cgroups or container-based isolation with constrained memory quotas can mitigate the impact by preventing any single process from consuming all available system resources. Monitoring tools should be configured to alert on unusual spikes in memory consumption associated with image processing services, allowing for rapid detection and response to potential exploitation attempts aimed at exhausting system stability.