CVE-2026-116146
Received Received - Intake

Memory Leak in ImageMagick MSL Decoder

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116146
EUVD
EUVD-2026-109407

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in ImageMagick's MSL decoder. When processing crafted MSL image files, the decoder fails to release allocated memory properly. This causes repeated memory leaks, leading to resource exhaustion and denial of service.

Detection Guidance

Detecting this vulnerability requires checking the installed version of ImageMagick. Run 'convert --version' or 'magick --version' to check the version. If the output shows a version before 6.9.13-58 or 7.x before 7.1.2-33, the system is vulnerable.

Impact Analysis

An attacker could exploit this by providing malicious MSL files, causing your system to run out of memory. This may slow down or crash applications using ImageMagick, disrupting normal operations.

Mitigation Strategies

Update ImageMagick to the latest patched version (6.9.13-58 or 7.1.2-33 or later). Remove or restrict access to MSL file processing if not required. Monitor system memory usage for unusual spikes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart