DEBIAN-CVE-2026-116143: Medium severity debian/imagemagick vulnerability

Q: Who is realistically exposed to this issue?

Systems using affected ImageMagick versions that process attacker-controlled PS, PDF, or XPS files are exposed. Exploitation requires an attacker to supply a specific argument and requires local, low-privileged access according to the provided vector.

Q: What is the practical impact of successful exploitation?

An attacker can bypass the configured security-policy list length limit for scene selection, causing ImageMagick to process more scenes than permitted. This may exhaust resources; the provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

Q: Which versions contain the policy bypass?

The issue affects ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than permitted, potentially exhausting resources.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems using affected ImageMagick versions that process attacker-controlled PS, PDF, or XPS files are exposed. Exploitation requires an attacker to supply a specific argument and requires local, low-privileged access according to the provided vector.

What is the practical impact of successful exploitation?

An attacker can bypass the configured security-policy list length limit for scene selection, causing ImageMagick to process more scenes than permitted. This may exhaust resources; the provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

Which versions contain the policy bypass?

The issue affects ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33.

DEBIAN-CVE-2026-116143: Medium severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What is the practical impact of successful exploitation?

Which versions contain the policy bypass?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What is the practical impact of successful exploitation?

Which versions contain the policy bypass?