CVE-2026-116157 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The identified security flaw resides within the PerlMagick interface, which serves as a bridge between the ImageMagick library and the Perl programming language. Specifically, this vulnerability affects versions prior to 7.1.2-33 and is classified as a memory leak resulting from improper resource management during the retrieval of image metadata. When an application utilizes PerlMagick to read properties associated with an image file, such as dimensions, color space, or EXIF data, the underlying C code allocates memory for the returned values but fails to release this allocated memory back to the system after use. This oversight creates a cumulative burden on the host environment's available RAM resources.
From a technical perspective, the root cause is categorized under CWE-401, which describes missing release of memory after effective usage. The vulnerability manifests across five distinct code locations within the PerlMagick module where property retrieval functions are invoked. Each invocation triggers an allocation that remains unreleased until the process terminates or crashes due to resource exhaustion. This behavior deviates from standard memory management practices expected in high-performance image processing libraries, leading to a gradual degradation of system performance over time as more images are processed with their properties accessed.
The operational impact of this vulnerability is primarily centered on denial of service conditions for applications relying on ImageMagick through PerlMagick. An attacker who can control the input data or trigger repeated property reads against an affected instance can systematically exhaust available memory resources. This exhaustion leads to application crashes, system instability, or complete unavailability of services that depend on image processing capabilities. In cloud-native environments or shared hosting scenarios where resource limits are enforced, this could result in container restarts or service throttling, effectively disrupting business continuity for dependent users and systems.
This type of vulnerability aligns with the ATT&CK technique T1496, Resource Hijacking, specifically within the context of denial of service through resource exhaustion. While not typically exploited for data exfiltration or direct system compromise in this specific instance, it represents a significant availability risk that adversaries could leverage to disrupt critical infrastructure or create noise during broader attack campaigns. The lack of automatic garbage collection or explicit deallocation calls in these code paths highlights the importance of rigorous memory auditing in libraries interfacing with lower-level languages like C from higher-level scripting environments.
To mitigate this vulnerability, organizations must upgrade ImageMagick and PerlMagick to version 7.1.2-33 or later, where the developers have addressed the missing deallocation logic for returned property values. Implementing automated dependency scanning tools can help identify outdated versions in production environments before they are exploited. Additionally, applying resource limits such as memory quotas at the container or process level can provide a layer of defense-in-depth, limiting the blast radius if an instance is targeted by repeated property read operations until patches can be applied and deployed across the infrastructure.