CVE-2026-116157
ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
4.8
MEDIUM
Scored by CNA (VulnCheck) · v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA CVSS 4.0 vector
LocalNo authUser action
Confidentiality NIntegrity NAvailability L
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | L | Local |
| Attack complexity AC | L | Low (easy) |
| Attack requirements AT | N | None |
| Privileges required PR | N | None |
| User interaction UI | P | Passive |
| Confidentiality (vulnerable system) VC | N | None |
| Integrity (vulnerable system) VI | N | None |
| Availability (vulnerable system) VA | L | Low |
| Confidentiality (subsequent systems) SC | N | None |
| Integrity (subsequent systems) SI | N | None |
| Availability (subsequent systems) SA | N | None |
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Description
CNA (VulnCheck)
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| CNA / VulnCheck | 4.0 | 4.8 MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA / VulnCheck | 3.1 | 3.3 LOW | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | affected: 0 … < 7.1.2-33 unaffected: 7.1.2-33 default: unaffected |