DEBIAN-CVE-2026-116154: Medium severity debian/imagemagick vulnerability

Q: Who can exploit this issue?

An unauthenticated remote attacker can exploit it if they can cause ImageMagick to parse attacker-controlled XML data. The attack requires a crafted document with deeply nested XML elements.

Q: What is the practical impact?

Repeated or sufficiently large crafted XML parsing requests can leak memory until available memory is exhausted, causing a denial of service. The provided CVSS data indicates availability impact only, with no stated confidentiality or integrity impact.

Q: Which ImageMagick versions are affected?

Affected versions are ImageMagick releases before 6.9.13-58 and 7.x releases before 7.1.2-33.

Q: What can be done if updating is not immediately possible?

Limit or prevent ImageMagick from processing untrusted XML input, particularly documents that may contain deeply nested elements. Restrict access to workflows or services that accept files from untrusted users to reduce remote exposure.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-58
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-33

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it if they can cause ImageMagick to parse attacker-controlled XML data. The attack requires a crafted document with deeply nested XML elements.

What is the practical impact?

Repeated or sufficiently large crafted XML parsing requests can leak memory until available memory is exhausted, causing a denial of service. The provided CVSS data indicates availability impact only, with no stated confidentiality or integrity impact.

Which ImageMagick versions are affected?

Affected versions are ImageMagick releases before 6.9.13-58 and 7.x releases before 7.1.2-33.

What can be done if updating is not immediately possible?

Limit or prevent ImageMagick from processing untrusted XML input, particularly documents that may contain deeply nested elements. Restrict access to workflows or services that accept files from untrusted users to reduce remote exposure.

DEBIAN-CVE-2026-116154: Medium severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

Which ImageMagick versions are affected?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

Which ImageMagick versions are affected?

What can be done if updating is not immediately possible?