{"id":"CVE-2026-116157","aliases":[],"cve":{"records":[{"id":"CVE-2026-116157","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-25T12:22:53.333Z","published":"2026-10-25T13:20:03.602Z","modified":"2026-10-26T19:48:36.366Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-25T13:20:03.602Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T19:48:36.366Z"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-perlmagick-property-reading","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-401","description":"Missing Release of Memory after Effective Lifetime","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.2-33"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T19:39:28.934489Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.","score":4.8,"severity":"medium","published":"2026-10-25T13:20:03.602Z","modified":"2026-10-26T19:48:36.366Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"ImageMagick","name":"ImageMagick","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"7.1.2-33","versionType":"custom"},{"version":"7.1.2-33","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-116157"}],"remediation":[],"references":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-perlmagick-property-reading"],"sources":[{"name":"CVE","id":"CVE-2026-116157","modified":"2026-10-26T19:48:36.366Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116157"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":4.8},{"source":"VulnCheck","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","score":3.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:34:50.880Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:05:32.453Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"ImageMagick before 7.1.2-33 has a memory leak in PerlMagick property reading, allowing attackers to cause denial of service by repeatedly triggering property reads. The weakness is due to missing memory release after its effective lifetime. Attackers need access to the affected system to exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:55:01.527Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-116157"}]}}