CVE-2026-116159 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in ImageMagick versions prior to 6.9.13-58 and 7.x prior to 7.1.2-33 represents a critical resource management flaw within the image processing engine, specifically affecting the handling of Color Decision List or CDL files. This component is designed to apply color grading transformations to images based on standardized parameters such as slope, offset, saturation, and opacity. The core technical deficiency lies in the memory allocation routines associated with parsing these CDL inputs. When ImageMagick processes a file containing valid but maliciously crafted CDL data, it allocates heap memory to store intermediate processing states or parsed values. However, due to an oversight in the cleanup logic, this allocated memory is not properly released back to the operating system after the operation completes or when subsequent operations are initiated on the same image context. This failure to deallocate resources constitutes a classic resource leak that accumulates over time as more images are processed through the vulnerable pipeline.
From a technical perspective, this flaw aligns with CWE-401, which describes missing release of memory after effective usage. The vulnerability is not triggered by buffer overflow or code injection but rather by the systematic exhaustion of system resources. An attacker does need to execute arbitrary code on the target machine; instead, they can exploit this weakness remotely if ImageMagick is configured to process untrusted image inputs as part of a web service or automated pipeline. By submitting a sequence of images that trigger the CDL processing path repeatedly, an adversary can induce continuous memory allocation without corresponding deallocation. This leads to a gradual but inevitable increase in the memory footprint of the ImageMagick process or the hosting application. As available system RAM is consumed by these leaked allocations, the host operating system may begin swapping memory to disk, causing severe performance degradation, latency spikes, and eventual service unavailability when physical memory limits are reached.
The operational impact of this vulnerability is primarily centered on availability rather than confidentiality or integrity. In environments where ImageMagick is used for high-volume image processing, such as e-commerce platforms handling user uploads, social media applications resizing profile pictures, or document conversion services, the ability to trigger a denial-of-service condition poses a significant risk. Attackers can leverage this flaw in automated attacks that send thousands of requests per minute, rapidly exhausting server resources and taking down critical infrastructure without requiring authentication credentials if the processing endpoint is publicly accessible. Even in internal systems where access might be restricted, insider threats or compromised accounts could exploit this weakness to disrupt business operations by causing application crashes or forcing restarts, leading to data loss for any uncommitted work currently held in memory.
Mitigation strategies must prioritize immediate patching and defensive configuration changes. The most effective remediation is upgrading ImageMagick to version 6.9.13-58 or later, or version 7.1.2-33 and above, where the developers have addressed the memory leak by ensuring proper cleanup of allocated resources after CDL processing completes. For organizations unable to patch immediately due to dependency constraints, implementing strict input validation is crucial. This includes limiting the size of uploaded images, restricting supported formats to only those necessary for business operations, and disabling the CDL delegate if it is not actively used in the workflow. Additionally, deploying resource limits such as ulimits on Linux systems or job objects on Windows can help contain the impact by capping the maximum memory a single process can consume, thereby preventing total system exhaustion even if an attack succeeds.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK technique T1496, which covers Resource Hijacking via Denial of Service through resource exhaustion. While often categorized under availability attacks, it is important for security teams to recognize that such flaws are frequently used as part of broader attack chains to distract defenders or create chaos during more critical intrusions. Monitoring tools should be configured to detect abnormal spikes in memory usage associated with ImageMagick processes, which can serve as an early warning indicator of exploitation attempts. Regular vulnerability scanning and maintaining a strict update policy for image processing libraries are essential practices to prevent recurrence of such resource management issues across the enterprise environment.