CVE-2026-116152
Received Received - Intake

Memory Leak in ImageMagick MAT Decoder

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks that gradually consume process memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116152
EUVD
EUVD-2026-109413

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in ImageMagick's MAT decoder. When processing certain files, the decoder fails to release allocated memory in an error path. Attackers can exploit this by repeatedly sending crafted MAT files, causing gradual memory consumption that may lead to system slowdowns or crashes.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command 'magick --version' or 'convert --version'. If the version is below 7.1.2-33, the system is vulnerable. Monitor memory usage for gradual increases when processing MAT files.

Impact Analysis

The impact includes degraded system performance due to memory exhaustion, potential application crashes, and possible denial-of-service conditions. Since the attack requires no privileges or user interaction, any system processing untrusted MAT files is at risk.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it primarily affects system availability through memory leaks rather than data confidentiality or integrity. However, repeated exploitation could lead to denial-of-service conditions, potentially disrupting services that handle sensitive data.

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-33 or later immediately. If upgrading is not possible, restrict access to MAT file processing or disable MAT decoder support in ImageMagick configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116152. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart