CVE-2026-116158: ImageMagick before 7.1.2-33 Memory Leak in magick compare

Q: What access would an attacker need to exploit this issue?

The attack vector is local and requires user interaction. An attacker would need to cause repeated failed operations through the magick compare command using supplied inputs.

Q: Are confidentiality or integrity affected?

No. The supplied severity vector indicates no confidentiality or integrity impact; the impact is limited to availability through memory exhaustion.

Q: Which deployments are exposed?

Deployments using ImageMagick versions before 7.1.2-33 are affected when the magick compare command can be invoked with attacker-supplied inputs.

Published Oct 25, 2026

Updated

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

Affected Software

1 affected component

ImageMagick ImageMagick<7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access would an attacker need to exploit this issue?

The attack vector is local and requires user interaction. An attacker would need to cause repeated failed operations through the magick compare command using supplied inputs.

Are confidentiality or integrity affected?

No. The supplied severity vector indicates no confidentiality or integrity impact; the impact is limited to availability through memory exhaustion.

Which deployments are exposed?

Deployments using ImageMagick versions before 7.1.2-33 are affected when the magick compare command can be invoked with attacker-supplied inputs.

CVE-2026-116158: ImageMagick before 7.1.2-33 Memory Leak in magick compare

Affected Software

Event History

Frequently Asked Questions

What access would an attacker need to exploit this issue?

Are confidentiality or integrity affected?

Which deployments are exposed?

Company

Resources

Contact

Frequently Asked Questions

What access would an attacker need to exploit this issue?

Are confidentiality or integrity affected?

Which deployments are exposed?