CVE-2026-116158

low

Description

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

References

https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-magick-compare

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m938-565c-h9qf

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109419

Details

Source: Mitre, NVD

Published: 2026-10-25

Updated: 2026-10-25

Risk Information

CVSS v2

Base Score: 1.2

Vector: CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:P

Severity: Low

CVSS v3

Base Score: 2.5

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Severity: Low

CVSS v4

Base Score: 2

Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Severity: Low