Cloudanix VulnDB

CVE-2026-116146

Low · 3.7

CVSS

3.7

EPSS

0.3%

Published

Oct 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in widely used image software lets attackers crash systems that handle pictures by sending specially made files that slowly use up all available memory.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak in the MSL decoder that fails to release allocated memory when processing crafted MSL images, leading to repeated allocation without deallocation and eventual resource exhaustion.

Why it matters to the business

Attackers can cause denial of service by exhausting memory on systems that process untrusted image files, resulting in application or service downtime and potential need for restarts.

How an attack unfolds

An attacker crafts a malicious MSL image file designed to trigger the leak, then supplies it to any ImageMagick-based image processing workflow such as web uploads, email attachments, or automated pipelines; repeated submissions accumulate leaked memory until the process or host runs out of resources.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or 7.1.2-33 or later; if immediate upgrade is not possible, restrict processing of untrusted MSL files or disable the MSL decoder.

How to confirm the fix worked

Confirm the installed ImageMagick version is at or above the fixed releases; test processing of a known triggering MSL sample while monitoring memory usage to verify the leak is absent.

Typical attack path

  1. Identify a target application or service that uses ImageMagick to decode MSL images
  2. Generate or obtain a crafted MSL file that triggers the decoder leak
  3. Deliver the file through an accepted input channel such as file upload or API
  4. Repeat delivery at sufficient volume to exhaust available memory
  5. Observe denial of service when the target process or system becomes unresponsive

How to detect it

Review application and system logs for repeated MSL image processing events; correlate with process memory growth metrics or out-of-memory events on hosts running ImageMagick.

What your security team should do

  • Apply the version upgrade to 6.9.13-58 or 7.1.2-33 across all ImageMagick deployments within standard change windows
  • Add file-type filtering or sandboxing for image processing workflows that accept user-supplied content
  • Monitor memory usage metrics for image-processing services and set alerts for anomalous growth

The record

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities