CVE-2026-116154

A flaw was found in ImageMagick. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting specially crafted, deeply nested XML data. When processing the input, the application fails to release allocated memory upon reaching the nesting depth limit, resulting in memory exhaustion.

This vulnerability is rated as having a Moderate impact because exploitation is restricted to denial of service through memory exhaustion, with no compromise of system confidentiality or integrity. In typical Red Hat deployments, ImageMagick operates as a transient command-line utility or batch processor, meaning memory reclaimed upon process termination mitigates persistent system-wide exhaustion unless repeatedly invoked by persistent server applications. Additionally, ImageMagick is not provided in core Red Hat Enterprise Linux 8 or 9 distributions, significantly limiting direct exposure in standard enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.