DEBIAN-CVE-2026-116155: Medium severity debian/imagemagick vulnerability

Q: Who is exposed to this issue?

Systems using Debian ImageMagick versions before 6.9.13-58 or 7.x before 7.1.2-33 are affected when they process attacker-supplied images containing crafted XMP profiles.

Q: What does an attacker need to exploit it?

An attacker needs to supply a crafted image with an XMP profile and have it processed by a vulnerable ImageMagick decoder. No privileges or user interaction are indicated by the provided severity vector.

Q: What is the likely impact?

Each processing event can leak memory, allowing repeated processing of crafted images to exhaust resources and cause a denial of service. The provided data does not indicate confidentiality or integrity impact.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using Debian ImageMagick versions before 6.9.13-58 or 7.x before 7.1.2-33 are affected when they process attacker-supplied images containing crafted XMP profiles.

What does an attacker need to exploit it?

An attacker needs to supply a crafted image with an XMP profile and have it processed by a vulnerable ImageMagick decoder. No privileges or user interaction are indicated by the provided severity vector.

What is the likely impact?

Each processing event can leak memory, allowing repeated processing of crafted images to exhaust resources and cause a denial of service. The provided data does not indicate confidentiality or integrity impact.

DEBIAN-CVE-2026-116155: Medium severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact?