CVE-2026-116154: imagemagick imagemagick

CVSS 6.9 (medium) · published 2026-10-25

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.

Affected products (NVD): imagemagick imagemagick

Fixed in (NVD): 6.9.13-58, 7.1.2-33

Weakness: CWE-401

Source: NVD CVE-2026-116154

References

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8ghq-p369-g395
• https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-via-xml-parsing-depth-limit

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.