CVE-2026-116154: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit

Q: Which deployments are exposed to this issue?

Deployments using ImageMagick versions before 6.9.13-58 or 7.x versions before 7.1.2-33 are affected when they parse attacker-supplied XML data.

Q: What does an attacker need to do to trigger the denial of service?

An attacker needs to provide crafted XML with deeply nested elements. Reaching the XML parser's nesting-depth limit causes allocated memory not to be released, allowing memory exhaustion.

Q: Is authentication or user interaction required for exploitation?

No. The reported vector is network-accessible and requires neither privileges nor user interaction, although the attacker must be able to get crafted XML processed by ImageMagick.

Q: What should be done if an immediate upgrade is not possible?

Prevent untrusted XML input from being processed by affected ImageMagick deployments, particularly deeply nested XML documents. Monitor affected processes for abnormal memory growth or memory-exhaustion failures while a fixed version is deployed.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, <7.1.2-33

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-58
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ImageMagick versions before 6.9.13-58 or 7.x versions before 7.1.2-33 are affected when they parse attacker-supplied XML data.

What does an attacker need to do to trigger the denial of service?

An attacker needs to provide crafted XML with deeply nested elements. Reaching the XML parser's nesting-depth limit causes allocated memory not to be released, allowing memory exhaustion.

Is authentication or user interaction required for exploitation?

No. The reported vector is network-accessible and requires neither privileges nor user interaction, although the attacker must be able to get crafted XML processed by ImageMagick.

What should be done if an immediate upgrade is not possible?

Prevent untrusted XML input from being processed by affected ImageMagick deployments, particularly deeply nested XML documents. Monitor affected processes for abnormal memory growth or memory-exhaustion failures while a fixed version is deployed.

CVE-2026-116154: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Is authentication or user interaction required for exploitation?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Is authentication or user interaction required for exploitation?

What should be done if an immediate upgrade is not possible?