Vulnerability record/PUBLISHED/Published Oct 25, 2026 13:20:04 UTC

CVE-2026-116158

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

Base score2.0/ 10

SeverityLowCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityLow

Attack vectorLocalAV

Attack complexityHighAC

Attack requirementsPresentAT

Privileges requiredNonePR

User interactionPassiveUI

Vulnerable system confidentialityNoneVC

Vulnerable system integrityNoneVI

Vulnerable system availabilityLowVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck

Last updatedOct 26, 2026 19:48:36 UTC

PublishedOct 25, 2026 13:20:04 UTC

ReservedOct 25, 2026 12:22:53 UTC