VulnSocial

CVE-2026-116154

LOWCVSS 6.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-401

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-29: 110-29
Referenced assets1 URL
Full discourse1 post
  • Vikas Anil Sharma@VikzSharma

    My latest security research uncovered two memory-leak vulnerabilities in ImageMagick, assigned CVEs: CVE-2026-116154 and CVE-2026-116155. Subtle flaws in XML/XMP parsing, with the potential to cause remote denial of service. 🔬 Both have been responsibly disclosed and patched. The full technical breakdown, reproduction, and ASan evidence are now live on the blog. 🔗 https://blog.agilehunt.com/blog/imagemagick-cve-2026-116154-xml-depth-limit-memory-leak #ImageMagick #CVE #VulnerabilityResearch

    0503291.5K
    2.1K followersView on X

Explore more

Back to dashboard