{"id":"CVE-2026-116141","title":"ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder (CVE-2026-116141)","summary":"A flaw was found in ImageMagick. A remote attacker could cause a Denial of Service (DoS) through excessive resource consumption by submitting a specially crafted Ultra High Dynamic Range (UHDR) image file. Because the UHDR decoder validate…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":["CWE-770","CWE-400"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","affected":["enterprise_linux 6","enterprise_linux 7"],"published":"2026-10-25","updated":"2026-10-25","sourceUpdated":"2026-10-25T14:05:12+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116141.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116141.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-116141"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560438"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116141"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116141"},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-in-uhdr-decoder"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-25T22:08:29.955Z","epss":0.00333,"epssPercentile":0.26371,"slug":"CVE-2026-116141","body":"## Overview\n\nA flaw was found in ImageMagick. A remote attacker could cause a Denial of Service (DoS) through excessive resource consumption by submitting a specially crafted Ultra High Dynamic Range (UHDR) image file. Because the UHDR decoder validates width and height boundaries only after decoding has completed rather than before processing, the application fully decodes oversized images and bypasses configured security policy limits.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116141.json)\n\n**ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder** — rated Moderate by Red Hat. Released 2026-10-25.\n\nAffected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}