CVE-2026-116143

A flaw was found in ImageMagick. This vulnerability allows a local attacker to cause a Denial of Service (DoS) through resource exhaustion. The PostScript (PS), Portable Document Format (PDF), and XML Paper Specification (XPS) decoders fail to properly enforce security policy list length limits on scene selection, allowing an attacker supplying specific arguments to trigger excessive processing.

This vulnerability is rated as Low severity because exploitation requires local access with specific argument inputs, and the impact is confined to excessive resource consumption without threatening system confidentiality or integrity. In standard Red Hat deployments, ImageMagick executes with local user privileges, restricting the denial-of-service blast radius to the invoking process. Additionally, the flaw only circumvents scene-selection list constraints during document parsing and cannot be leveraged for code execution or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable processing of PostScript (PS), Portable Document Format (PDF), and XML Paper Specification (XPS) files within the ImageMagick security policy.

Edit the ImageMagick policy configuration file (typically /etc/ImageMagick-6/policy.xml) and add the following lines inside the <policymap> section:

<policy domain="coder" rights="none" pattern="PS" />
<policy domain="coder" rights="none" pattern="PDF" />
<policy domain="coder" rights="none" pattern="XPS" />

Caveats: Disabling these decoders prevents ImageMagick from reading or rendering PS, PDF, and XPS files, which will impact workflows requiring these formats. If ImageMagick is called by persistent background services or web applications, restart those services for the configuration changes to take full effect.