DEBIAN-CVE-2026-116151: Medium severity debian/imagemagick vulnerability

Q: Which deployments are exposed to this issue?

Debian systems using ImageMagick versions earlier than 6.9.13-58 or 7.x versions earlier than 7.1.2-33 are affected when they process attacker-controlled images through the JNG encoding path.

Q: What does an attacker need to do to exploit it?

An attacker needs to provide a crafted image that the affected ImageMagick installation will encode as JNG. No authentication or user interaction is required, but exploitation has high attack complexity and requires the relevant processing condition.

Q: What is the likely impact?

Repeated processing of crafted images can leak memory and potentially exhaust resources, resulting in a limited denial of service. The provided impact metrics indicate availability impact only, with no indicated confidentiality or integrity impact.

Q: What can be done before upgrading?

Avoid accepting or processing untrusted images through JNG encoding until ImageMagick is updated. Limit exposure of services that perform image conversion and apply resource limits where possible.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-58
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-33

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Debian systems using ImageMagick versions earlier than 6.9.13-58 or 7.x versions earlier than 7.1.2-33 are affected when they process attacker-controlled images through the JNG encoding path.

What does an attacker need to do to exploit it?

An attacker needs to provide a crafted image that the affected ImageMagick installation will encode as JNG. No authentication or user interaction is required, but exploitation has high attack complexity and requires the relevant processing condition.

What is the likely impact?

Repeated processing of crafted images can leak memory and potentially exhaust resources, resulting in a limited denial of service. The provided impact metrics indicate availability impact only, with no indicated confidentiality or integrity impact.

What can be done before upgrading?

Avoid accepting or processing untrusted images through JNG encoding until ImageMagick is updated. Limit exposure of services that perform image conversion and apply resource limits where possible.

DEBIAN-CVE-2026-116151: Medium severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

What is the likely impact?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

What is the likely impact?

What can be done before upgrading?