CVE-2026-116150
Description
A flaw was found in ImageMagick. An attacker can exploit this vulnerability to cause a Denial of Service (DoS) through memory exhaustion. By submitting a specially crafted image for FlashPix (FPX) encoding, memory allocated during processing is not properly released. Repeatedly processing these images can exhaust available system memory, causing the application to become unresponsive or terminate.
Statement
This vulnerability is rated as Low impact because triggering the memory leak requires specifically invoking the FPX encoder with crafted input, causing cumulative resource depletion rather than arbitrary code execution or data exposure. In typical Red Hat Enterprise Linux usage, ImageMagick CLI tools operate as short-lived processes where allocated memory is automatically reclaimed by the operating system upon termination. Furthermore, ImageMagick is not included in the core distribution for supported versions such as RHEL 8 and 9, substantially limiting overall exposure.
Mitigation
Disable the FlashPix (FPX) coder in ImageMagick's security policy.
Add the following rule inside the `<policymap>` section of `/etc/ImageMagick-6/policy.xml` (or `/etc/ImageMagick/policy.xml`):
xml
<policy domain="coder" rights="none" pattern="FPX" />
Caveats: Disabling this coder prevents ImageMagick from reading or writing files in the FPX format. If ImageMagick is utilized by long-running daemons or web applications, those services must be restarted for the policy changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.1 | N/A | 3.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
