| Name | CVE-2026-116157 |
| Description | ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-4875-1, DSA-6611-1 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| imagemagick (PTS) | bookworm | 8:6.9.11.60+dfsg-1.6+deb12u11 | vulnerable |
| bookworm (security) | 8:6.9.11.60+dfsg-1.6+deb12u15 | fixed |
| trixie | 8:7.1.1.43+dfsg1-1+deb13u12 | vulnerable |
| trixie (security) | 8:7.1.1.43+dfsg1-1+deb13u14 | fixed |
| forky, sid | 8:7.1.2.34+dfsg1-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/eef3af56fbc2dc607e185b8565d695a8d8032d73 (7.1.2-33)
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/fb8842ff7ab351cd85a253c780fbfcf1199d7e4c (7.1.2-33)