CVE-2026-116141GHSA-h3qx-937j-245g
ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder
ImageMagick ImageMagickLibraries & packages
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.1.2-33ImageMagickCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.
Text from CVE List
Affected versions 2
- ImageMagickaffected: all versions before 7.1.2-33CVE List
- ImageMagickunaffected: 7.1.2-33CVE List