CVE-2026-116158
ImageMagick before 7.1.2-33 Memory Leak in magick compare
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
2.0
LOW
Scored by CNA (VulnCheck) · v4.0
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA CVSS 4.0 vector
LocalNo authUser actionConditions
Confidentiality NIntegrity NAvailability L
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | L | Local |
| Attack complexity AC | H | High (conditions required) |
| Attack requirements AT | P | Present |
| Privileges required PR | N | None |
| User interaction UI | P | Passive |
| Confidentiality (vulnerable system) VC | N | None |
| Integrity (vulnerable system) VI | N | None |
| Availability (vulnerable system) VA | L | Low |
| Confidentiality (subsequent systems) SC | N | None |
| Integrity (subsequent systems) SI | N | None |
| Availability (subsequent systems) SA | N | None |
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Description
CNA (VulnCheck)
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| CNA / VulnCheck | 4.0 | 2.0 LOW | CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA / VulnCheck | 3.1 | 2.5 LOW | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | affected: 0 … < 7.1.2-33 unaffected: 7.1.2-33 default: unaffected |
Linux distribution status
References (2)
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m938-565c-h9qf CNA vendor-advisory
- https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-magick-compare CNA third-party-advisory