ImageMagick leaks XMP parameter-entity strings (CVE-2026-116155)
Original title: CVE-2026-116155: ImageMagick Memory Leak via Crafted XMP Profile
Fixed in ImageMagick 7.1.2-33 and 6.9.13-58; reject XMP profiles in policy.xml as a stopgap.
ParseInternalDoctype stores parameter-entity values from an XMP DOCTYPE internal subset in a local vector and frees the vector without destroying the owned strings. Every entity value leaks on both the success and error paths. ImageMagick 7.1.2-33 and 6.9.13-58 fix the leak. Operators can reject XMP profiles through policy.xml until they upgrade.
- The leak is in xml-tree.c when the local vector is freed at line 1565.
- Both the success path and the error path leak the owned value strings.
- Fixed releases are ImageMagick 7.1.2-33 and 6.9.13-58.
- A stopgap is to reject XMP profiles in policy.xml.
Impact: leaks parameter-entity value strings from crafted XMP profiles
| Product | Affected | Fixed in |
|---|---|---|
| ImageMagick | — | 7.1.2-33 or 6.9.13-58 |
- 1.Upgrade to ImageMagick 7.1.2-33 or 6.9.13-58.
- 2.Reject XMP profiles via policy.xml until upgraded.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-116155 | Memory leak in ImageMagick XMP profile handling | 6.9 | — |
From the original article
1 min read at agilehunt.com
CVE-2026-116155: ImageMagick Memory Leak via Crafted XMP Profile in ParseInternalDoctype ParseInternalDoctype stores parameter-entity values from an XMP DOCTYPE internal subset in a local vector, frees the vector at xml-tree. c:1565, but never destroys the owned value strings — every <! ENTITY %> value is leaked on both the success and error paths.
By agilehunt.com via ndr · agilehunt.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.