| Name | CVE-2026-116154 |
| Description | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-4875-1, DSA-6611-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| imagemagick (PTS) | bookworm | 8:6.9.11.60+dfsg-1.6+deb12u11 | vulnerable |
| bookworm (security) | 8:6.9.11.60+dfsg-1.6+deb12u15 | fixed | |
| trixie | 8:7.1.1.43+dfsg1-1+deb13u12 | vulnerable | |
| trixie (security) | 8:7.1.1.43+dfsg1-1+deb13u14 | fixed | |
| forky, sid | 8:7.1.2.34+dfsg1-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| imagemagick | source | bookworm | 8:6.9.11.60+dfsg-1.6+deb12u15 | DLA-4875-1 | ||
| imagemagick | source | trixie | 8:7.1.1.43+dfsg1-1+deb13u14 | DSA-6611-1 | ||
| imagemagick | source | (unstable) | 8:7.1.2.33+dfsg1-1 |
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8ghq-p369-g395
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/33d16f3cf4e0439bba4a874e14c5a3168726ed68 (7.1.2-33)
Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/41bce657a379675706039b97dffc313806b39d23 (6.9.13-58)