DEBIAN-CVE-2026-116141: Medium severity debian/imagemagick vulnerability

Q: Which systems should be prioritized for remediation?

Debian systems using ImageMagick versions before 7.1.2-33 should be prioritized, particularly where ImageMagick processes UHDR images supplied by untrusted or remote users.

Q: Does exploitation require authentication or user interaction?

No. The vulnerability is rated as network-accessible with low attack complexity, no privileges required, and no user interaction required; an attacker needs to provide a crafted UHDR image.

Q: What is the practical impact of a successful exploit?

A crafted image can be fully decoded with oversized dimensions before ImageMagick enforces configured width and height limits. This can cause excessive resource consumption and affect availability.

Published Oct 25, 2026

Updated

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.

Affected Software

2 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems should be prioritized for remediation?

Debian systems using ImageMagick versions before 7.1.2-33 should be prioritized, particularly where ImageMagick processes UHDR images supplied by untrusted or remote users.

Does exploitation require authentication or user interaction?

No. The vulnerability is rated as network-accessible with low attack complexity, no privileges required, and no user interaction required; an attacker needs to provide a crafted UHDR image.

What is the practical impact of a successful exploit?

A crafted image can be fully decoded with oversized dimensions before ImageMagick enforces configured width and height limits. This can cause excessive resource consumption and affect availability.

DEBIAN-CVE-2026-116141: Medium severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems should be prioritized for remediation?

Does exploitation require authentication or user interaction?

What is the practical impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Which systems should be prioritized for remediation?

Does exploitation require authentication or user interaction?

What is the practical impact of a successful exploit?