What is the CVSS score of CVE-2026-116160?

CVE-2026-116160 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-116160?

Yes, a patch is available for CVE-2026-116160. Update the affected software to the latest version immediately.

ImageMagick CVE-2026-116160

EUVD-2026-109421 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-10-25 VulnCheck

GHSA-6g2x-3g93-88jh

Buffer Overflow Heap Overflow Red Hat Imagemagick

4.8

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Deliver crafted image to victim
Exploit

Victim runs ImageMagick X11 animate on file
Execution

Heap buffer over-write during processing
Impact

Application crashes (denial of service)

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to run an ImageMagick X11 animate operation (the `animate`/X11 display path) on an attacker-supplied crafted image, in an environment with an X11 display available. The vector is local (AV:L) and demands user interaction (UI:P) - the attacker cannot trigger it remotely or without a user acting on the file. Impact is limited to a heap over-write that crashes the application (availability only, VA:L); the available evidence does not confirm confidentiality/integrity loss or code execution. Not applicable to deployments that do not invoke the X11 animate operation. Affected: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33.
Impact	This is a genuinely low-to-moderate priority issue despite being a memory-corruption bug. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores 4.8 (medium) and is internally consistent with the description: the attack vector is LOCAL (AV:L), requires passive user interaction (UI:P - a user must run the X11 animate operation on the file), and the only impact is a limited availability loss (VA:L) with no confidentiality or integrity impact. The description states the overflow 'can crash the application' - evidence supports a denial-of-service/crash outcome, not confirmed code execution. There is no CISA KEV listing and no EPSS score supplied, so there is no signal of active or probable widespread exploitation; the vuln.today priority is 'this_month' (not act_now/emergency), consistent with a patch-on-normal-cycle item. No SSVC decision fields (automatable/technical impact) were provided to compare against. The references are vendor/researcher advisories (ImageMagick GHSA and VulnCheck), not verified working exploit code. Net: a real but low-urgency bug - local vector plus required user interaction and availability-only impact make this far less pressing than its CWE class (heap overflow) might suggest.
Exploit ScenarioDerived	An attacker crafts a malicious image and delivers it to a victim (e.g., via download or shared file). When the victim runs an ImageMagick X11 animate operation on that image, the heap buffer over-write corrupts memory and crashes the application. No public exploit code is identified in the provided data; the GHSA and VulnCheck entries are advisories, and the local vector plus required user interaction limit realistic impact to a crash.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 25, 2026

Heap buffer overflow in ImageMagick's X11 animate path (versions before 6.9.13-58 and 7.x before 7.1.2-33) allows an attacker-supplied crafted image to overwrite heap memory and crash the application when a user runs an X11 animate operation with an X11 display available. Exploitation requires local user interaction and the available assessment limits impact to availability; no public exploit was identified at time of analysis. Vendor patches are available in 6.9.13-58 and 7.1.2-33.

RemediationAI

Upgrade ImageMagick to 6.9.13-58 or later on the 6.x branch, or to 7.1.2-33 or later on the 7.x branch; the vendor advisory is https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p6q-wfrv-ffhh and the VulnCheck advisory is https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-heap-buffer-overflow-via-x11-animate. For environments that cannot upgrade immediately, avoid running the X11 animate operation on attacker-supplied images; the assessment notes the issue is not applicable to deployments that do not invoke that path. No separate vendor workaround is described in the supplied sources.

Affected VersionsENISA

ImageMagick 0 <6.9.13-58

ImageMagick 7.0.0-0 <7.1.2-33

Affected Packages

euvd imagemagick fix: 6.9.13-58, 7.1.2-33

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

ImageMagick is an image processing library and command-line toolkit; the X11 animate operation displays image sequences through an X11 display. CVE-2026-116160 is a CWE-122 heap-based buffer overflow in which a crafted image processed through that animate/X11 path can overwrite heap memory and crash the application. The supplied advisory and CPE data identify ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 as affected, and public tagging classifies the issue as a buffer overflow/heap overflow in ImageMagick; the sources do not describe the exact image parser or heap layout involved, and the assessed impact is availability only.

Know when Imagemagick gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

vuln.today AI 3.3 LOW

Local X11-animate processing of a crafted file means AV:L and UI:R; no auth needed so PR:N; evidence states only a crash, so C:N/I:N/A:L.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Red Hat 3.3 LOW

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Oct 25, 2026 - 14:01 EUVD

CVE Published

Oct 25, 2026 - 13:20 cve.org

MEDIUM 4.8

DescriptionCVE.org

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.

Threat Intelligence Overview

EPSS Score

0.1%

Top 98% exploitable

Prevalence

High

ImageMagick is a widely deployed image-processing library across Linux and servers

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +24

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.