---
id: CVE-2026-116157
title: ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading
summary: >-
  ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick
  that fails to free values returned when reading image properties. Attackers
  can repeatedly trigger property reads through five affected PerlMagick code
  locati…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-401
  - CWE-772
vendor: ImageMagick
product: ImageMagick
affected:
  - ImageMagick < 7.1.2-33
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T19:39:28.934489Z'
published: '2026-10-25'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T19:48:36.366Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116157'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3
    label: GitHub Security Advisory (GHSA-pj4h-g4pf-66v3)
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-perlmagick-property-reading
    label: >-
      VulnCheck Advisory: ImageMagick before 7.1.2-33 Memory Leak in PerlMagick
      Property Reading
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116157.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-116157'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2560451'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-116157'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-116157'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00111
epssPercentile: 0.01353
ingestedAt: '2026-10-25T22:08:29.951Z'
---

## Overview

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.

## Affected

- `ImageMagick < 7.1.2-33`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116157.json)