DEBIAN-CVE-2026-116158: Low severity debian/imagemagick vulnerability

Q: Who is realistically exposed to this issue?

Systems running ImageMagick versions before 7.1.2-33 are affected when an attacker can cause the magick compare command to process attacker-supplied inputs. The impact is memory exhaustion and denial of service.

Q: What does an attacker need to exploit it?

An attacker needs to supply inputs that cause compare operations to fail repeatedly. Exploitation also requires the ability to trigger those repeated operations against the affected command.

Q: How can I tell whether my system is affected?

Check whether the installed ImageMagick version is earlier than 7.1.2-33. Also determine whether the magick compare command processes untrusted inputs and can be invoked repeatedly.

Published Oct 25, 2026

Updated

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems running ImageMagick versions before 7.1.2-33 are affected when an attacker can cause the magick compare command to process attacker-supplied inputs. The impact is memory exhaustion and denial of service.

What does an attacker need to exploit it?

An attacker needs to supply inputs that cause compare operations to fail repeatedly. Exploitation also requires the ability to trigger those repeated operations against the affected command.

How can I tell whether my system is affected?

Check whether the installed ImageMagick version is earlier than 7.1.2-33. Also determine whether the magick compare command processes untrusted inputs and can be invoked repeatedly.

DEBIAN-CVE-2026-116158: Low severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether my system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether my system is affected?