CVE-2026-116151: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder

Q: Which deployments are exposed?

Deployments using ImageMagick versions earlier than 6.9.13-58 or 7.x versions earlier than 7.1.2-33 are affected when they encode attacker-supplied images to JNG.

Q: What must an attacker be able to do?

An attacker must be able to supply a crafted image that the affected ImageMagick deployment processes and encodes as JNG. No privileges or user interaction are required, but exploitation has high attack complexity.

Q: What is the likely impact?

The leak can consume memory and potentially cause resource exhaustion, resulting in a limited denial of service. The provided information indicates no confidentiality or integrity impact.

Q: How can the issue be remediated?

Upgrade ImageMagick to 6.9.13-58 or later, or to 7.1.2-33 or later within the 7.x branch.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, <7.1.2-33

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-58
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using ImageMagick versions earlier than 6.9.13-58 or 7.x versions earlier than 7.1.2-33 are affected when they encode attacker-supplied images to JNG.

What must an attacker be able to do?

An attacker must be able to supply a crafted image that the affected ImageMagick deployment processes and encodes as JNG. No privileges or user interaction are required, but exploitation has high attack complexity.

What is the likely impact?

The leak can consume memory and potentially cause resource exhaustion, resulting in a limited denial of service. The provided information indicates no confidentiality or integrity impact.

How can the issue be remediated?

Upgrade ImageMagick to 6.9.13-58 or later, or to 7.1.2-33 or later within the 7.x branch.

CVE-2026-116151: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do?

What is the likely impact?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do?

What is the likely impact?

How can the issue be remediated?