CVE-2026-116159: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-116159 is a memory leak vulnerability in ImageMagick's handling of the -cdl (color decision list) option, where allocated memory is not properly released after use. It affects ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33. The vulnerability was published on October 25, 2026, with the original security advisory (GHSA-c2qq-jqw7-q4mx) credited to reporter manus-pi and published by maintainer dlemstra on October 10, 2026. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime), indicating that memory allocated during -cdl option processing is never freed (GitHub Advisory). The attack vector is local, requiring user interaction — an attacker must supply crafted input that causes ImageMagick to process the -cdl option, either directly via command-line invocation or indirectly through an application that passes user-controlled input to ImageMagick. By repeatedly triggering this code path, an attacker can cause progressive memory exhaustion on the host system. No privileges are required to supply the malicious input, but the attack is constrained to local access (Red Hat Bugzilla, GitHub Advisory Database).

Successful exploitation results in a denial-of-service condition through resource exhaustion, with availability being the only impacted security property — there is no confidentiality or integrity impact. An unauthenticated local user who can interact with ImageMagick (e.g., by submitting image files to a processing pipeline) can degrade or crash the service by repeatedly triggering the -cdl code path, consuming system memory until the process or host becomes unresponsive (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a target: Locate a system running ImageMagick before version 6.9.13-58 (6.x branch) or before 7.1.2-33 (7.x branch) where local access or file submission to an ImageMagick processing pipeline is possible.
2. Craft malicious input: Prepare an image file or command invocation that causes ImageMagick to process the -cdl (color decision list) option, for example: convert input.png -cdl malicious.cdl output.png.
3. Repeat invocations: Automate repeated execution of the above command (e.g., via a script loop) to continuously trigger the memory leak without freeing allocated memory between runs.
4. Achieve resource exhaustion: As memory accumulates without being released, the system's available memory is progressively consumed, eventually causing the ImageMagick process or dependent service to crash or become unresponsive (GitHub Advisory, Red Hat Bugzilla).

• Process Behavior: ImageMagick processes (convert, magick) showing steadily increasing memory consumption over time without returning memory to the OS; processes consuming abnormally large amounts of RAM relative to the size of images being processed.
• Logs: System logs (e.g., /var/log/syslog, /var/log/messages) recording OOM (out-of-memory) killer events targeting ImageMagick processes; application logs showing repeated image processing failures or crashes.
• File System: Presence of unusual or numerous .cdl (color decision list) files submitted to an image processing directory, particularly if submitted by an untrusted source.
• System Metrics: Sudden drops in available system memory correlated with ImageMagick processing activity; swap usage spikes during batch image processing jobs.

Upgrade ImageMagick to version 6.9.13-58 or later (for the 6.x branch) or 7.1.2-33 or later (for the 7.x branch), which include the fix for this memory leak (GitHub Advisory). As interim mitigations, implement process-level memory quotas (e.g., via ulimit or cgroup memory limits) to cap the memory available to ImageMagick processes, preventing unbounded consumption. Restrict local access to ImageMagick processing pipelines where possible, and monitor ImageMagick processes for abnormal memory usage patterns (Red Hat Bugzilla).