CVE-2026-116157: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-116157 is a memory leak vulnerability in ImageMagick's PerlMagick component that can lead to denial of service. Affecting ImageMagick versions before 7.1.2-33, the flaw stems from five code locations in PerlMagick that fail to free memory values returned when reading image properties. The vulnerability was published on October 25, 2026, with a patch available in version 7.1.2-33. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). Specifically, five distinct locations in PerlMagick's property-reading code paths return allocated memory values without subsequently freeing them, causing cumulative heap memory growth with each invocation. Exploitation requires local access and user interaction (e.g., processing a crafted image file), and an attacker can repeatedly trigger these property read operations to progressively exhaust available system memory (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results solely in a denial-of-service condition through memory exhaustion; there is no impact on confidentiality or data integrity. An attacker who can cause repeated image property read operations via PerlMagick can degrade or crash the ImageMagick service, potentially affecting any application or pipeline that depends on it for image processing. The scope is limited to the vulnerable system, with no lateral movement or data exposure risk identified (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory Database, Red Hat Bugzilla).

The primary remediation is to upgrade ImageMagick to version 7.1.2-33 or later, which resolves all five affected PerlMagick code locations (GitHub Advisory). As interim measures, administrators should implement rate limiting on image processing requests, monitor system memory usage for ImageMagick processes, and consider restricting access to image property read operations where feasible (Red Hat Bugzilla).