CVE-2026-116155: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile

Q: Which deployments are affected?

ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected. The issue is in XMP profile handling by various decoders.

Q: What does an attacker need to exploit this issue?

An attacker needs to supply an image containing a crafted XMP profile and have it processed by an affected ImageMagick installation. No privileges or user interaction are required according to the supplied vector.

Q: What is the practical impact?

Each processing event can leak memory. Repeated processing of crafted images can exhaust resources and cause a denial of service.

Q: How can the issue be remediated?

Upgrade ImageMagick to 6.9.13-58 or later, or to 7.1.2-33 or later for the 7.x branch.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, <7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected. The issue is in XMP profile handling by various decoders.

What does an attacker need to exploit this issue?

An attacker needs to supply an image containing a crafted XMP profile and have it processed by an affected ImageMagick installation. No privileges or user interaction are required according to the supplied vector.

What is the practical impact?

Each processing event can leak memory. Repeated processing of crafted images can exhaust resources and cause a denial of service.

How can the issue be remediated?

Upgrade ImageMagick to 6.9.13-58 or later, or to 7.1.2-33 or later for the 7.x branch.

CVE-2026-116155: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the practical impact?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the practical impact?

How can the issue be remediated?