CVE-2026-116147: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder

Q: Which deployments are affected?

ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected when they process DJVU images.

Q: What must an attacker do to trigger the issue?

An attacker must provide a DJVU image for ImageMagick to process. The crash occurs only under conditions where the relevant memory allocation fails.

Q: What is the impact of successful exploitation?

Successful exploitation crashes the ImageMagick process, causing denial of service. The provided data does not indicate confidentiality or integrity impact.

Q: How can I remediate this issue?

Upgrade ImageMagick to 6.9.13-58 or later, or to 7.1.2-33 or later for the 7.x branch.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process and causes a denial of service.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, <7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected when they process DJVU images.

What must an attacker do to trigger the issue?

An attacker must provide a DJVU image for ImageMagick to process. The crash occurs only under conditions where the relevant memory allocation fails.

What is the impact of successful exploitation?

Successful exploitation crashes the ImageMagick process, causing denial of service. The provided data does not indicate confidentiality or integrity impact.

How can I remediate this issue?

Upgrade ImageMagick to 6.9.13-58 or later, or to 7.1.2-33 or later for the 7.x branch.

CVE-2026-116147: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to trigger the issue?

What is the impact of successful exploitation?

How can I remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to trigger the issue?

What is the impact of successful exploitation?

How can I remediate this issue?