CVE-2026-116141: ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder

Q: Who is exposed to this issue?

Deployments using ImageMagick versions before 7.1.2-33 are affected when they process attacker-supplied UHDR images. Network-reachable image-processing services are exposed if an attacker can submit such files for decoding.

Q: What does an attacker need to exploit it?

An attacker needs to provide a crafted UHDR image with oversized dimensions for ImageMagick to decode. The listed vector indicates exploitation does not require privileges or user interaction.

Q: Are configured image dimension limits sufficient protection?

No. The vulnerability allows width and height policy limits to be bypassed because extent checks occur only after the UHDR image has already been decoded.

Q: What is the impact of successful exploitation?

A crafted image can cause excessive resource consumption during decoding, resulting in an availability impact. The provided severity vector indicates no confidentiality or integrity impact.

Published Oct 25, 2026

Updated

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.

Affected Software

1 affected component

ImageMagick ImageMagick<7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments using ImageMagick versions before 7.1.2-33 are affected when they process attacker-supplied UHDR images. Network-reachable image-processing services are exposed if an attacker can submit such files for decoding.

What does an attacker need to exploit it?

An attacker needs to provide a crafted UHDR image with oversized dimensions for ImageMagick to decode. The listed vector indicates exploitation does not require privileges or user interaction.

Are configured image dimension limits sufficient protection?

No. The vulnerability allows width and height policy limits to be bypassed because extent checks occur only after the UHDR image has already been decoded.

What is the impact of successful exploitation?

A crafted image can cause excessive resource consumption during decoding, resulting in an availability impact. The provided severity vector indicates no confidentiality or integrity impact.

CVE-2026-116141: ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are configured image dimension limits sufficient protection?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are configured image dimension limits sufficient protection?

What is the impact of successful exploitation?