DEBIAN-CVE-2026-116156: Medium severity debian/imagemagick vulnerability

Q: What conditions are required for exploitation?

An attacker must induce a user to process an image with ImageMagick using the -set profile option. The issue is locally exploitable and requires user interaction; no privileges are required.

Q: What is the practical impact?

Repeated triggering can leak memory and potentially exhaust available resources, resulting in a denial of service. The provided metrics indicate no direct impact to confidentiality or integrity.

Q: Which ImageMagick versions are affected?

ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must induce a user to process an image with ImageMagick using the -set profile option. The issue is locally exploitable and requires user interaction; no privileges are required.

What is the practical impact?

Repeated triggering can leak memory and potentially exhaust available resources, resulting in a denial of service. The provided metrics indicate no direct impact to confidentiality or integrity.

Which ImageMagick versions are affected?

ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected.

DEBIAN-CVE-2026-116156: Medium severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact?

Which ImageMagick versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact?

Which ImageMagick versions are affected?