CVE-2026-116147

A flaw was found in ImageMagick. This vulnerability allows an attacker to cause a Denial of Service (DoS) by supplying a specially crafted DJVU image file. When ImageMagick processes the image under conditions where memory allocation fails, the DJVU decoder fails to validate the allocation result, causing the application to crash.

Red Hat has classified this vulnerability as having a Low severity impact because triggering the flaw requires specific, uncommon preconditions where memory allocation fails during file parsing, and the outcome is limited to a process crash. In typical Red Hat deployments, ImageMagick operates as a transient command-line tool or non-persistent helper, restricting the blast radius to the active conversion task. Furthermore, successful exploitation does not grant unauthorized access, leak sensitive data, or compromise system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the DJVU format decoder in ImageMagick's security policy configuration:

1. Open the ImageMagick policy file (typically /etc/ImageMagick/policy.xml or /etc/ImageMagick-6/policy.xml).
2. Add the following entry within the <policymap> block:

<policy domain="coder" rights="none" pattern="DJVU" />

Caveats: Disabling the DJVU coder prevents ImageMagick from reading or converting DJVU files, which will impact workflows requiring this format.

Warning: If ImageMagick is executed by persistent application daemons or web services (such as Apache HTTP Server or PHP-FPM), restart those services to ensure the policy changes take effect.