DEBIAN-CVE-2026-116159: Medium severity debian/imagemagick vulnerability

Q: Which ImageMagick versions contain the fix?

The issue is fixed in ImageMagick 6.9.13-58 and later, and in 7.1.2-33 and later. Earlier versions in the respective branches are affected.

Q: What must an attacker be able to do to trigger the resource exhaustion?

An attacker must be able to supply input that causes ImageMagick to process the -cdl color decision list option. Repeated processing leaks allocated memory and can degrade availability through resource exhaustion.

Q: What is the expected impact of successful exploitation?

The described impact is availability degradation from memory exhaustion. The provided vector indicates local attack access and user interaction, with no stated impact on confidentiality or integrity.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which ImageMagick versions contain the fix?

The issue is fixed in ImageMagick 6.9.13-58 and later, and in 7.1.2-33 and later. Earlier versions in the respective branches are affected.

What must an attacker be able to do to trigger the resource exhaustion?

An attacker must be able to supply input that causes ImageMagick to process the -cdl color decision list option. Repeated processing leaks allocated memory and can degrade availability through resource exhaustion.

What is the expected impact of successful exploitation?

The described impact is availability degradation from memory exhaustion. The provided vector indicates local attack access and user interaction, with no stated impact on confidentiality or integrity.

DEBIAN-CVE-2026-116159: Medium severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which ImageMagick versions contain the fix?

What must an attacker be able to do to trigger the resource exhaustion?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which ImageMagick versions contain the fix?

What must an attacker be able to do to trigger the resource exhaustion?

What is the expected impact of successful exploitation?