CVE-2026-116141
ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
6.9
MEDIUM
Scored by CNA (VulnCheck) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA CVSS 4.0 vector
NetworkNo authNo interaction
Confidentiality NIntegrity NAvailability L
This vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Attack requirements AT | N | None |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Confidentiality (vulnerable system) VC | N | None |
| Integrity (vulnerable system) VI | N | None |
| Availability (vulnerable system) VA | L | Low |
| Confidentiality (subsequent systems) SC | N | None |
| Integrity (subsequent systems) SI | N | None |
| Availability (subsequent systems) SA | N | None |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Description
CNA (VulnCheck)
ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| CNA / VulnCheck | 4.0 | 6.9 MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA / VulnCheck | 3.1 | 5.3 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | affected: 0 … < 7.1.2-33 unaffected: 7.1.2-33 default: unaffected |
Linux distribution status
References (2)
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g CNA vendor-advisory
- https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-in-uhdr-decoder CNA third-party-advisory