CVE-2026-116152

What it actually does

The vulnerability is a memory leak in the MAT image decoder where allocated memory is not freed on certain error conditions, allowing repeated processing of malicious files to exhaust available memory.

Why it matters to the business

Applications using ImageMagick to process images may experience gradual memory exhaustion, leading to service degradation or crashes when handling untrusted MAT files.

How an attack unfolds

An attacker crafts a malicious MAT file that triggers an error path in the decoder without freeing memory. By sending multiple such files to a service using ImageMagick, the attacker causes memory to leak over time until the process runs out of memory and crashes.

How to fix it

Upgrade ImageMagick to version 7.1.2-33 or later.

How to confirm the fix worked

Confirm the installed ImageMagick version is 7.1.2-33 or higher and verify that processing of test MAT files triggering the error path no longer results in unreleased memory allocations.

Typical attack path

1. Identify a target application or service that uses vulnerable ImageMagick to decode images
2. Craft a MAT file designed to trigger the specific error path in the MAT decoder
3. Repeatedly submit the crafted MAT file through available input channels such as uploads or network requests
4. Observe progressive memory consumption leading to denial of service

How to detect it

Review application and image processing logs for repeated MAT file handling; monitor process memory metrics for unexplained gradual increases correlated with image decode activity.

What your security team should do

• Update ImageMagick to 7.1.2-33 or later in all environments as soon as possible given the recent publication
• Disable or restrict MAT file processing until patches are applied if the functionality is non-essential
• Implement memory usage monitoring and alerts for ImageMagick processes