ImageMagick CVE-2026-116155

Exploitation requires that the target run an affected ImageMagick version (before 6.9.13-58 in the 6.x branch, or 7.x before 7.1.2-33) and that it process attacker-supplied images through a decoder that handles XMP profiles - i.e. the image must actually reach ImageMagick for decoding (typical in upload/thumbnail/conversion pipelines). Per the CVSS 4.0 vector, no authentication (PR:N) and no user interaction (UI:N) are required, and the vector is network-reachable (AV:N) against default configurations wherever ImageMagick decodes untrusted images. The key LIMITING factor is impact scope: this is a memory leak causing gradual resource exhaustion (availability only, VA:L), so a single request is not catastrophic - meaningful denial of service requires repeated processing of the crafted images to accumulate the leak, and there is no confidentiality or integrity impact. The exact decoders affected and the specific malformed XMP structure that triggers the leak are not described in the available sources.

This is a medium-severity, availability-only denial-of-service issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no authentication or user interaction, but the only impact metric set is VA:L - no confidentiality or integrity impact and only partial availability impact - which correctly caps the score at 6.9 (Medium). The flaw is CWE-401 (memory leak): each processed crafted XMP profile leaks a bounded amount of memory, so impact is cumulative/gradual exhaustion rather than an instant crash, consistent with VA:L rather than VA:H. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or probable exploitation; the two references are the ImageMagick GHSA advisory and a VulnCheck advisory, which are disclosure advisories, not verified working exploit code. The vuln.today priority is 'this_month' (not act_now/emergency), aligning with a real-but-non-urgent DoS. Net: a genuine issue worth patching on a normal cycle given ImageMagick's broad deployment in image-processing pipelines, but not a high-urgency, code-execution-class emergency.

An attacker uploads or submits an image carrying a crafted XMP profile to any service that runs it through an affected ImageMagick decoder (for example a web application that generates thumbnails from user uploads). Each time such an image is parsed, a chunk of memory is leaked and never freed; by repeatedly submitting these images the attacker gradually exhausts available memory and degrades or crashes the processing service. No public exploit identified at time of analysis; the published material is vendor/third-party advisories rather than verified exploit code.