CVE-2026-116158

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

Score

CVSS 3.1 2.5 Low

Status

Awaiting Analysis - disclosure@vulncheck.com

Published

2026-10-25

Last modified

2026-10-26

Weaknesses

CWE-401

Affected products

• Imagemagick (Imagemagick)

References

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m938-565c-h9qf
• https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-magick-compare