CVE-2026-116146: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder

Q: Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 6.9.13-58 or 7.x versions earlier than 7.1.2-33 are affected when they process MSL images.

Q: What does an attacker need to exploit the issue?

An attacker needs to cause the affected ImageMagick instance to process crafted MSL files. Repeated processing can leak memory until resource exhaustion causes a denial of service.

Q: Does exploitation require authentication or user interaction?

No authentication or user interaction is required according to the supplied CVSS vector. Exploitation has high attack complexity and is network-reachable.

Q: What versions address the issue?

Upgrade ImageMagick to 6.9.13-58 or later, or to 7.1.2-33 or later within the 7.x release line.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, <7.1.2-33

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-58
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 6.9.13-58 or 7.x versions earlier than 7.1.2-33 are affected when they process MSL images.

What does an attacker need to exploit the issue?

An attacker needs to cause the affected ImageMagick instance to process crafted MSL files. Repeated processing can leak memory until resource exhaustion causes a denial of service.

Does exploitation require authentication or user interaction?

No authentication or user interaction is required according to the supplied CVSS vector. Exploitation has high attack complexity and is network-reachable.

What versions address the issue?

Upgrade ImageMagick to 6.9.13-58 or later, or to 7.1.2-33 or later within the 7.x release line.

CVE-2026-116146: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

Does exploitation require authentication or user interaction?

What versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

Does exploitation require authentication or user interaction?

What versions address the issue?