CVE-2026-116158: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-116158 is a memory leak vulnerability in ImageMagick's magick compare command caused by missing cleanup when a compare operation fails. Affected versions are all ImageMagick releases before 7.1.2-33. The vulnerability was published on October 25, 2026, with the upstream security advisory (GHSA-m938-565c-h9qf) originally published on October 10, 2026. It carries a CVSS v3.1 base score of 2.5 (Low) and a CVSS v4.0 base score of 2.0 (Low) (ImageMagick Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime): when the magick compare command encounters a failed operation, it does not perform the necessary memory cleanup, leaving allocated memory unreleased (ImageMagick Advisory, Github Advisory). The attack vector is local, requires high attack complexity, no privileges, and passive user interaction — meaning an attacker must supply crafted inputs that cause repeated compare failures, typically by convincing a user or automated pipeline to process malicious image files (Red Hat Bugzilla). No public proof-of-concept code has been identified.

Successful exploitation results in a denial-of-service condition: repeated failed compare operations cause unbounded memory consumption, potentially exhausting system memory and rendering the ImageMagick process — or the host system — unresponsive or crashed (Red Hat Bugzilla, ImageMagick Advisory). There is no impact on confidentiality or integrity; the vulnerability is limited to availability. Systems that use ImageMagick in automated image-processing pipelines (e.g., web applications accepting user-uploaded images) may be at elevated risk if untrusted inputs reach the compare functionality.

There is no evidence of active in-the-wild exploitation, no public proof-of-concept, and no known exploit kits targeting this vulnerability (Github Advisory). The EPSS score is 0.0, reflecting negligible probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory). The high attack complexity and requirement for user interaction further reduce practical exploitability.

1. Identify target: Locate a system or application running ImageMagick before version 7.1.2-33 that exposes the magick compare command to user-supplied inputs (e.g., an image processing web service or automated pipeline).
2. Craft malicious inputs: Prepare image files or input parameters specifically designed to trigger a failed compare operation within ImageMagick (e.g., mismatched image dimensions, unsupported formats, or corrupted image data).
3. Induce repeated failures: Submit the crafted inputs repeatedly — either directly via the command line if local access is available, or by repeatedly uploading files to an application that invokes magick compare — to trigger the memory leak on each failed operation.
4. Exhaust memory: Continue supplying failing inputs until system memory is sufficiently exhausted to cause the ImageMagick process or the host system to become unresponsive or crash, achieving denial of service (Red Hat Bugzilla, ImageMagick Advisory).

• Process Behavior: Steadily increasing memory consumption by the magick or compare process without corresponding release; process eventually becoming unresponsive or crashing.
• Logs: Repeated error messages from ImageMagick's compare command indicating failed operations (e.g., compare: ... error lines in application or system logs) in rapid succession from the same source.
• System: Out-of-memory (OOM) killer events in /var/log/syslog or dmesg output referencing the magick or compare process; sudden drops in available system memory correlated with image processing activity.
• File System: High volume of temporary or input image files in directories used by the image processing pipeline, particularly files with unusual formats or corrupted content.

Upgrade ImageMagick to version 7.1.2-33 or later, which includes the fix for missing cleanup in the compare command (ImageMagick Advisory). As an interim workaround, restrict local access to the ImageMagick compare functionality and avoid exposing it to untrusted inputs; monitor for unusual memory consumption patterns that may indicate exploitation attempts (Red Hat Bugzilla). Applications that process user-supplied images should validate and sanitize inputs before passing them to ImageMagick, and consider enforcing resource limits (e.g., ulimit or cgroup memory limits) on ImageMagick processes.