Is CVE-2026-116159 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116159?

CVE-2026-116159 has a CVSS v3 severity of LOW (3.3).

Back

CVE-2026-116159

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.