CVE-2026-116155

A flaw was found in ImageMagick. A remote attacker could cause a Denial of Service (DoS) by supplying an image with a specially crafted Extensible Metadata Platform (XMP) profile. When affected decoders process the malformed profile, memory is repeatedly leaked, which can eventually lead to system resource exhaustion.

This vulnerability is evaluated as Moderate severity because prolonged processing of maliciously crafted metadata can gradually deplete system memory in persistent services, while confidentiality and system integrity remain completely unaffected. Within standard Red Hat Enterprise Linux deployments, one-off command-line executions release all allocated heap space immediately upon termination, preventing cumulative memory exhaustion. The operational risk is primarily confined to long-running daemons or multi-tenant web applications that repeatedly parse untrusted image files without restarting worker processes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.