---
id: CVE-2026-116154
title: >-
  ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML
  Parsing Depth Limit
summary: >-
  ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in
  its XML parsing code, where allocated memory is not released when parsing
  reaches the nesting depth limit. Attackers can supply crafted, deeply nested
  XML dat…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-401
  - CWE-772
vendor: ImageMagick
product: ImageMagick
affected:
  - ImageMagick >= 7.0.0-0 < 7.1.2-33
  - ImageMagick < 6.9.13-58
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-26T19:41:37.383736Z'
published: '2026-10-25'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T19:58:39.363Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116154'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8ghq-p369-g395
    label: GitHub Security Advisory (GHSA-8ghq-p369-g395)
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-via-xml-parsing-depth-limit
    label: >-
      VulnCheck Advisory: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33
      Memory Leak via XML Parsing Depth Limit
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116154.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-116154'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2560414'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-116154'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-116154'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00304
epssPercentile: 0.2307
ingestedAt: '2026-10-25T22:08:29.952Z'
---

## Overview

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.

## Affected

- `ImageMagick >= 7.0.0-0 < 7.1.2-33`
- `ImageMagick < 6.9.13-58`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116154.json)