CVE-2026-116141
ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 25, 2026
- Updated
- Oct 29, 2026
- Reserved
- Oct 25, 2026
Description
ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
ImageMagickImageMagick |
|
References
- GitHub Security Advisory (GHSA-h3qx-937j-245g)vendor-advisory
- VulnCheck Advisory: ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoderthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.