ImageMagick CVE-2026-116158

Exploitation requires the ability to supply inputs to the 'magick compare' command and to cause compare operations to fail repeatedly, on a local host or within an automated/service pipeline that runs compare against attacker-influenced images. The CVSS vector is local (AV:L) with passive user/operator interaction (UI:P in 4.0), meaning an operator or process must actually invoke compare on the supplied inputs - it is not a remotely reachable network service. Limiting factors: impact is confined to gradual memory exhaustion (VA:L, no C/I impact), a single failed operation leaks only a small amount so many repeated failures are needed to achieve DoS, and there is no exposure of data or code execution. No special non-default configuration is called out beyond use of the compare functionality on untrusted input.

This is a low-priority issue despite ImageMagick's wide deployment. The supplied CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L) yields a base score of only 2.0, reflecting a local attack vector, required user/operator interaction, and an availability-only impact rated Low - there is no confidentiality or integrity impact. No EPSS score was provided in the input, there is no CISA KEV listing, and no confirmed working exploit code was supplied - only vendor/advisory references (GHSA and VulnCheck), so exploitation probability cannot be quantified from the data. The vuln.today Decision label is 'monitor', which is consistent with all the severity signals: a slow, gradual memory leak that requires repeated failed operations to meaningfully exhaust memory. The signals are internally consistent (no conflicting high-CVSS-but-low-risk tension here) - this is genuinely a low-urgency maintenance fix, not an emergency, and a patch is already available.

An attacker who can feed inputs to a system that invokes 'magick compare' - for example an automated image-comparison pipeline accepting untrusted images - supplies inputs that cause the compare operation to fail. Because cleanup is missing on the failure path, each failed operation leaks memory, and repeating this gradually exhausts available memory to cause a denial of service. No public exploit code is identified at time of analysis; the GHSA and VulnCheck entries are advisories, not verified working exploits.