CVE-2026-116151

A flaw was found in ImageMagick. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted image file to be encoded into the JPEG Network Graphics (JNG) format. Due to a failure to properly release allocated memory in the JNG encoder, processing these files can lead to memory exhaustion and service instability.

This vulnerability is rated as Low severity because triggering the memory leak requires encoding files into the uncommon JNG format, and the blast radius is restricted to minor resource consumption without affecting system integrity or confidentiality. In typical Red Hat Enterprise Linux environments, ImageMagick runs primarily as a short-lived command-line utility where process termination automatically frees allocated memory, limiting the impact of memory leaks. Sustained resource exhaustion would only occur in long-running services or batch conversion pipelines that repeatedly process untrusted input directed to the JNG encoder.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the JNG coder in the ImageMagick security policy configuration.

To prevent the JNG encoder from being invoked, edit the ImageMagick policy configuration file (such as /etc/ImageMagick-6/policy.xml or /etc/ImageMagick-7/policy.xml, depending on the installed distribution) and insert the following line within the <policymap> element:

<policy domain="coder" rights="none" pattern="JNG" />

Caveats: Disabling the JNG coder will prevent ImageMagick from reading or generating JNG files. Any workflows or applications relying specifically on JNG conversion will fail.

Warning: If ImageMagick is used by persistent background processes or web application daemons, those services must be restarted for the policy changes to take effect.