CVE-2026-116142

A flaw was found in ImageMagick. When generating minimum-bounding-box output for an image, the application can read past allocated memory boundaries, resulting in a heap buffer over-read. An attacker could exploit this flaw by supplying a specially crafted image file to be processed. Successful exploitation could lead to information disclosure by exposing adjacent heap memory data, or cause the application to crash, resulting in a Denial of Service (DoS).

This vulnerability affects only ImageMagick 7.x, which introduced the minimum-bounding-box output feature containing the heap buffer over-read. No Red Hat product is affected by this flaw. Red Hat Enterprise Linux ships ImageMagick 6.x (RHEL 6 ELS and RHEL 7 ELS), which does not contain the vulnerable code path. Community builds available through Fedora and EPEL that ship ImageMagick 7.x already include the upstream fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.