CVE-2026-116156: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option

Q: Which deployments are affected?

ImageMagick versions before 6.9.13-58 are affected, as are 7.x versions before 7.1.2-33. The issue is associated with processing images using the -set profile option.

Q: What must an attacker do to trigger the issue?

An attacker must induce a user to process images with the -set profile option. The vector is local, requires user interaction, and does not require privileges.

Q: What is the practical impact?

The missing cleanup causes a memory leak. Repeated or sustained triggering can exhaust resources and cause denial of service; no confidentiality or integrity impact is specified.

Q: What should be done if the affected option is needed?

Upgrade to ImageMagick 6.9.13-58 or later in the 6.x line, or 7.1.2-33 or later in the 7.x line. Until then, avoid processing attacker-influenced images with the -set profile option where possible.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, >=7.0.0<7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ImageMagick versions before 6.9.13-58 are affected, as are 7.x versions before 7.1.2-33. The issue is associated with processing images using the -set profile option.

What must an attacker do to trigger the issue?

An attacker must induce a user to process images with the -set profile option. The vector is local, requires user interaction, and does not require privileges.

What is the practical impact?

The missing cleanup causes a memory leak. Repeated or sustained triggering can exhaust resources and cause denial of service; no confidentiality or integrity impact is specified.

What should be done if the affected option is needed?

Upgrade to ImageMagick 6.9.13-58 or later in the 6.x line, or 7.1.2-33 or later in the 7.x line. Until then, avoid processing attacker-influenced images with the -set profile option where possible.

CVE-2026-116156: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to trigger the issue?

What is the practical impact?

What should be done if the affected option is needed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to trigger the issue?

What is the practical impact?

What should be done if the affected option is needed?