xmp

CVE-2026-116155 discloses a memory leak in ImageMagick's ParseInternalDoctype, where parameter-entity values from crafted XMP DOCTYPE internal subsets are never freed; users are advised to upgrade to ImageMagick 7.1.2-33 or 6.9.13-58 or block XMP profiles via policy.xml.