CVE-2026-116156: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-116156 is a memory leak vulnerability in ImageMagick caused by a missing cleanup when the -set profile option is used during image processing. It affects ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33. The vulnerability was published on October 25, 2026, with the upstream security advisory (GHSA-7r5g-p7ff-jgcp) credited to reporter manus-pi and published by maintainer dlemstra on October 10, 2026. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is classified under CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime), where allocated memory is not properly freed after the -set profile option completes its operation. The attack vector is local, requiring an attacker to convince a user or automated image-processing workflow to invoke ImageMagick with the -set profile flag on a crafted image — no privileges are required, but user interaction is necessary. Repeated invocations can progressively exhaust available system memory, leading to a denial of service condition. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a gradual exhaustion of system memory resources, potentially rendering the ImageMagick process and dependent services unavailable — a denial of service impact. There is no impact on confidentiality or data integrity, and the scope is limited to the vulnerable system without lateral movement potential. Environments that use ImageMagick in automated pipelines (e.g., web applications processing user-uploaded images) are at elevated risk if untrusted input can trigger the -set profile code path (Red Hat Advisory, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Red Hat Advisory).

1. Identify a target: Locate a system or service running a vulnerable version of ImageMagick (before 6.9.13-58 or 7.x before 7.1.2-33) that processes images using the -set profile option, such as an image upload or conversion service.
2. Craft a trigger: Prepare an image file (e.g., JPEG, PNG) intended to be processed with the -set profile option, which can be a standard image since the vulnerability lies in the option handling, not the image content itself.
3. Induce processing: Convince a user or automated workflow to process the image using a command such as convert input.jpg -set profile icc output.jpg, either through social engineering, a malicious upload, or by injecting the image into a processing queue.
4. Repeat to exhaust memory: Submit the image repeatedly (or in bulk) to trigger the memory leak iteratively, causing the ImageMagick process to accumulate unreleased memory allocations over time.
5. Achieve denial of service: As system memory is progressively exhausted, the ImageMagick process and potentially other services on the host become unresponsive or crash (GitHub Advisory, Red Hat Bugzilla).

• Process Behavior: ImageMagick processes (convert, magick) showing steadily increasing memory consumption over time without corresponding release; processes consuming abnormally large amounts of RAM when processing images with -set profile.
• Logs: System logs (e.g., /var/log/syslog, /var/log/messages) recording OOM (Out of Memory) killer events targeting ImageMagick processes; application logs showing repeated image processing requests with the -set profile flag from the same source.
• Network: High-frequency image upload or processing requests from a single IP or user account targeting endpoints that invoke ImageMagick with profile-setting options.
• System Metrics: Sudden or gradual spikes in memory utilization on hosts running ImageMagick-based image processing services, particularly correlated with image processing activity (Red Hat Bugzilla).

Upgrade ImageMagick to version 6.9.13-58 or later (for the 6.x branch) or 7.1.2-33 or later (for the 7.x branch) to apply the fix. As a workaround, restrict or disable use of the -set profile option in image processing workflows, particularly for untrusted or user-supplied input. Implement resource limits (e.g., ulimit, cgroups) on ImageMagick processes to cap memory usage and prevent complete system memory exhaustion. Validate and sanitize all image processing requests to prevent untrusted input from reaching vulnerable code paths (GitHub Advisory, Red Hat Bugzilla).