CVE-2026-116141

A flaw was found in ImageMagick. A remote attacker could cause a Denial of Service (DoS) through excessive resource consumption by submitting a specially crafted Ultra High Dynamic Range (UHDR) image file. Because the UHDR decoder validates width and height boundaries only after decoding has completed rather than before processing, the application fully decodes oversized images and bypasses configured security policy limits.

The UHDR decoder affected by this vulnerability is only present in ImageMagick 7.x. Red Hat Enterprise Linux and EPEL ship ImageMagick 6.x, which does not include the UHDR decoder. Fedora ships ImageMagick 7.1.2-34, which already contains the upstream fix. No Red Hat product is affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.