---
id: CVE-2026-116154
title: >-
  ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML
  Parsing Depth Limit
summary: >-
  ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in
  its XML parsing code, where allocated memory is not released when parsing
  reaches the nesting depth limit. Attackers can supply crafted, deeply nested
  XML dat…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-401
vendor: ImageMagick
product: ImageMagick
affected:
  - ImageMagick >= 7.0.0-0 < 7.1.2-33
  - ImageMagick < 6.9.13-58
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T13:20:01.714Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116154'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8ghq-p369-g395
    label: GitHub Security Advisory (GHSA-8ghq-p369-g395)
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-via-xml-parsing-depth-limit
    label: >-
      VulnCheck Advisory: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33
      Memory Leak via XML Parsing Depth Limit
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.952Z'
---

## Overview

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.

## Affected

- `ImageMagick >= 7.0.0-0 < 7.1.2-33`
- `ImageMagick < 6.9.13-58`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.