CVE-2026-116159: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option

Q: Which ImageMagick versions are affected?

ImageMagick releases before 6.9.13-58 are affected in the 6.x series, and releases before 7.1.2-33 are affected in the 7.x series. Upgrade to at least the applicable fixed version.

Q: What conditions are required for exploitation?

An attacker must be able to cause ImageMagick to process the -cdl option repeatedly. The CVSS vector indicates local attack access and required user interaction, with no privileges required.

Q: What can be done while an upgrade is pending?

Avoid processing attacker-controlled input through workflows that use the -cdl option. Limiting repeated invocation of that option reduces the opportunity for memory exhaustion.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, >=7.0.0<7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which ImageMagick versions are affected?

ImageMagick releases before 6.9.13-58 are affected in the 6.x series, and releases before 7.1.2-33 are affected in the 7.x series. Upgrade to at least the applicable fixed version.

What conditions are required for exploitation?

An attacker must be able to cause ImageMagick to process the -cdl option repeatedly. The CVSS vector indicates local attack access and required user interaction, with no privileges required.

What can be done while an upgrade is pending?

Avoid processing attacker-controlled input through workflows that use the -cdl option. Limiting repeated invocation of that option reduces the opportunity for memory exhaustion.

CVE-2026-116159: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option

Affected Software

Event History

Frequently Asked Questions

Which ImageMagick versions are affected?

What conditions are required for exploitation?

What can be done while an upgrade is pending?

Company

Resources

Contact

Frequently Asked Questions

Which ImageMagick versions are affected?

What conditions are required for exploitation?

What can be done while an upgrade is pending?