{"id":"CVE-2026-116158","aliases":[],"cve":{"records":[{"id":"CVE-2026-116158","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-25T12:22:53.333Z","published":"2026-10-25T13:20:04.263Z","modified":"2026-10-26T19:48:36.208Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-25T13:20:04.263Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T19:48:36.208Z"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m938-565c-h9qf","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-magick-compare","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-401","description":"Missing Release of Memory after Effective Lifetime","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.2-33"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T19:39:21.951991Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"ImageMagick before 7.1.2-33 Memory Leak in magick compare","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.","score":2.5,"severity":"low","published":"2026-10-25T13:20:04.263Z","modified":"2026-10-26T19:48:36.208Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"ImageMagick","name":"ImageMagick","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"7.1.2-33","versionType":"custom"},{"version":"7.1.2-33","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-116158"}],"remediation":[],"references":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m938-565c-h9qf","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-magick-compare"],"sources":[{"name":"CVE","id":"CVE-2026-116158","modified":"2026-10-26T19:48:36.208Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116158"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":2},{"source":"VulnCheck","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","score":2.5}],"sourceAffected":[],"observedAt":"2026-10-29T14:34:50.880Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:05:32.453Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"ImageMagick before 7.1.2-33 has a memory leak in the magick compare command, allowing attackers to cause denial of service by triggering repeated failed operations. The weakness is due to missing memory cleanup when an operation fails. Attackers need to supply specific inputs to exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:56:08.391Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-116158"}]}}