Is CVE-2026-116155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116155 being exploited in the wild.

How severe is CVE-2026-116155?

Medium severity, with a CVSS score of 5.3, published 25 October 2026.

Which products and versions are affected?

ImageMagick 6.x before 6.9.13-58, 7.x before 7.1.2-33.

Is there a fix for CVE-2026-116155?

Yes: fixed in 6.9.13-58, 7.1.2-33. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116155 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116155?

Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116155: ImageMagick memory leak in XMP profile handling

CVE-2026-116155 · Severity: medium · CVSS 5.3 · Published 2026-10-25

ImageMagick is a widely-used image processing library. An attacker can craft image files with malicious XMP profiles that cause the library to leak memory each time the image is processed. Repeated processing of such images leads to resource exhaustion and denial of service, potentially crashing systems that rely on ImageMagick for image handling.

Technologies: ImageMagick. Vendors: ImageMagick.

Quick answers

Is CVE-2026-116155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116155 being exploited in the wild.
How severe is CVE-2026-116155?: Medium severity, with a CVSS score of 5.3, published 25 October 2026.
Which products and versions are affected?: ImageMagick 6.x before 6.9.13-58, 7.x before 7.1.2-33.
Is there a fix for CVE-2026-116155?: Yes: fixed in 6.9.13-58, 7.1.2-33. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116155 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116155?: Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.9.13-58, 7.1.2-33

Technical details

A memory leak exists in ImageMagick's XMP profile parsing across multiple decoders (CWE-401: Missing Release of Memory after Effective Lifetime). An attacker can supply a crafted image with a malicious XMP profile; when processed by vulnerable versions, memory is not properly freed on each decode operation. Network vectors and no user interaction are required; the vulnerability is triggered by processing the image file itself.

Affected products

ImageMagick ImageMagick 6.x before 6.9.13-58, 7.x before 7.1.2-33

Timeline

2026-10-10: disclosed: GitHub Security Advisory GHSA-5jf2-9gcp-q234 published
2026-10-25: advisory: NVD CVE-2026-116155 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.