CVE-2026-116159

A flaw was found in ImageMagick. The handling of the color decision list (-cdl) option fails to properly release allocated memory after use. An attacker can exploit this issue by providing input that repeatedly processes the -cdl option, leading to excessive memory consumption and a Denial of Service (DoS) through resource exhaustion.

This vulnerability is rated as having a Low impact because ImageMagick is predominantly executed in Red Hat Enterprise Linux as a short-lived command-line tool, where any leaked memory is automatically released by the operating system upon process termination. Exploitation requires invoking the utility with the specific color decision list (-cdl) option, confining potential memory exhaustion strictly to custom scripts or persistent services that repeatedly process untrusted arguments. The issue does not compromise system integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.