CVE-2026-116150

A flaw was found in ImageMagick. An attacker can exploit this vulnerability to cause a Denial of Service (DoS) through memory exhaustion. By submitting a specially crafted image for FlashPix (FPX) encoding, memory allocated during processing is not properly released. Repeatedly processing these images can exhaust available system memory, causing the application to become unresponsive or terminate.

This vulnerability is rated as Low impact because triggering the memory leak requires specifically invoking the FPX encoder with crafted input, causing cumulative resource depletion rather than arbitrary code execution or data exposure. In typical Red Hat Enterprise Linux usage, ImageMagick CLI tools operate as short-lived processes where allocated memory is automatically reclaimed by the operating system upon termination. Furthermore, ImageMagick is not included in the core distribution for supported versions such as RHEL 8 and 9, substantially limiting overall exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.