UBUNTU-CVE-2026-116151: Medium severity ubuntu/imagemagick vulnerability
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-58 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-33
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using affected ImageMagick versions are exposed when they process attacker-supplied images and encode them to JNG. The impact is limited to memory consumption and potential denial of service.
What must an attacker do to trigger the leak?
An attacker must provide a crafted image that the affected ImageMagick instance processes through the JNG encoder. No privileges or user interaction are required, but exploitation has high attack complexity.
Are current ImageMagick releases affected?
The issue affects ImageMagick releases before 6.9.13-58 and 7.x releases before 7.1.2-33. Versions at or beyond those stated fixed releases are not identified as affected by the provided advisory information.
What can be done if an update cannot be applied immediately?
Avoid encoding untrusted images to JNG until the affected ImageMagick package can be updated. Restricting or disabling JNG output for untrusted input reduces exposure to the vulnerable encoder path.