Memory Leak Vulnerability in ImageMagick Software
CVE-2026-116146

6.3MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116146?

A memory leak exists in the MSL decoder of ImageMagick, affecting versions prior to 6.9.13-58 and 7.x before 7.1.2-33. When processing specially crafted MSL images, the software fails to properly release allocated memory. This oversight allows attackers to exploit the vulnerability by supplying malicious MSL files, leading to continuous memory leakage, which can ultimately result in resource exhaustion and denial of service for users.

Affected Version(s)

ImageMagick 7.0.0-0 < 7.1.2-33

ImageMagick 0 < 6.9.13-58

ImageMagick 7.1.2-33

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/imagemagick-before-6...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kb2l
.