ImageMagick leaks XMP parameter-entity strings (CVE-2026-116155)
Fixed in ImageMagick 7.1.2-33 and 6.9.13-58; reject XMP profiles in policy.xml as a stopgap.
46
Vulnerability1 · 1 read
CVE-2026-116155
Memory leak in ImageMagick XMP profile handling
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
ImageMagick leaks memory when various decoders handle a crafted XMP profile. An attacker who can supply an image for processing can trigger the leak on each processing pass, exhausting resources and causing denial of service. No authentication or user interaction is required if the service accepts untrusted images over the network. Builds before 6.9.13-58 and 7.x before 7.1.2-33 are affected.
What to do: Upgrade ImageMagick to 6.9.13-58 or 7.1.2-33. No workaround is stated.
| Product | Affected | Fixed in |
|---|---|---|
| ImageMagick | before 6.9.13-58 | 6.9.13-58 |
| ImageMagick | 7.x before 7.1.2-33 | 7.1.2-33 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.
- Weakness
- CWE-401
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X