CVE-2026-116146

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder

Published Oct 25, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service.

Analysis

Technical impact

The vulnerability is a memory leak in the MSL decoder of ImageMagick, causing memory that is allocated during processing of crafted images to never be released. Attackers can feed malicious MSL files repeatedly, leading the process to consume increasing amounts of memory and eventually crash or halt, resulting in a denial‑of‑service condition.

Affected Systems

ImageMagick versions prior to 6.9.13‑58 and 7.x prior to 7.1.2‑33 are affected. The issue applies to any installation of the ImageMagick library that processes MSL images, including command‑line tools and applications that employ the library.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. EPSS is currently unavailable, so exploitation potential cannot be quantified, but the vulnerability can be triggered by supplying MSL images, which may be possible during image ingestion or upload functionality. The vulnerability is not listed in the CISA KEV catalog, and no public exploit was reported at the time of the advisory. An attacker who can feed crafted files to a vulnerable ImageMagick process could exhaust memory and cause a service outage.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`7.0.0-0`	affected	< 7.1.2-33
`7.1.2-33`	unaffected	—

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 6.9.13-58
`6.9.13-58`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:imagemagick:imagemagick::::::::
	cpe:2.3:a:imagemagick:imagemagick::::::::

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[7.0.0-0,7.1.2-33)`	affected	semver	—
`7.1.2-33`	unaffected	semver	—

Imagemagick

Version	Status	Scheme	Platform
`[0,6.9.13-58)`	affected	generic	—
`6.9.13-58`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ImageMagick to at least 6.9.13‑58 or 7.1.2‑33.
If an upgrade is not immediately possible, disable MSL format support or block the processing of MSL files.
Configure resource limits such as cgroup quotas or memory limits on ImageMagick processes to prevent exhaustion.
Monitor memory usage of ImageMagick processes and restart them if memory consumption approaches critical levels.

Generated by OpenCVE AI on October 26, 2026 at 01:53 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4875-1	imagemagick security update

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.273% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j657-rmv3-4m94
https://nvd.nist.gov/vuln/detail/CVE-2026-116146
https://www.cve.org/CVERecord?id=CVE-2026-116146
https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-in-msl-decoder

History

Oct 26, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116146 https://www.cve.org/CVERecord?id=CVE-2026-116146
Metrics	threat_severity `None`	threat_severity `Low`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service.
Title		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-401
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j657-rmv3-4m94 https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-in-msl-decoder
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`