---
id: CVE-2026-116141
title: ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder
summary: >-
  ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR
  decoder that allows attackers to evade image width and height limits because
  extent checks occur after decoding. Attackers can supply crafted UHDR images
  with…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-770
vendor: ImageMagick
product: ImageMagick
affected:
  - ImageMagick < 7.1.2-33
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-29T19:51:35.202350Z'
published: '2026-10-25'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T19:51:45.323Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116141'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g
    label: GitHub Security Advisory (GHSA-h3qx-937j-245g)
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-in-uhdr-decoder
    label: >-
      VulnCheck Advisory: ImageMagick before 7.1.2-33 Policy Bypass in UHDR
      Decoder
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116141.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-116141'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2560438'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-116141'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-116141'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00333
epssPercentile: 0.26532
ingestedAt: '2026-10-25T22:08:29.955Z'
---

## Overview

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.

## Affected

- `ImageMagick < 7.1.2-33`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116141.json)