CVE-2026-116146

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder

State: Published
Severity: 6.3 Medium
Published: Oct 25, 2026
Updated: Oct 26, 2026
Reserved: Oct 25, 2026

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L	VulnCheck

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
ImageMagickImageMagick	7.0.0-0 to before 7.1.2-33Affected 7.1.2-33Not affected
ImageMagickImageMagick	before 6.9.13-58Affected 6.9.13-58Not affected

References

GitHub Security Advisory (GHSA-j657-rmv3-4m94)vendor-advisory
VulnCheck Advisory: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoderthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.