CVE-2026-116152: ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path

Q: Which deployments are exposed to this issue?

Deployments using ImageMagick versions before 7.1.2-33 are affected when they process attacker-supplied MAT files. The issue is in the MAT decoder error path.

Q: What does an attacker need to do to trigger the leak?

An attacker needs to supply a crafted MAT file that reaches the affected decoder error path. Repeated processing of such files can gradually consume process memory.

Q: What is the practical impact of repeated exploitation?

The leak can cause a gradual increase in process memory use. Repeated triggering may lead to reduced availability as process memory is consumed.

Published Oct 25, 2026

Updated

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks that gradually consume process memory.

Affected Software

1 affected component

ImageMagick ImageMagick<7.1.2-33

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ImageMagick versions before 7.1.2-33 are affected when they process attacker-supplied MAT files. The issue is in the MAT decoder error path.

What does an attacker need to do to trigger the leak?

An attacker needs to supply a crafted MAT file that reaches the affected decoder error path. Repeated processing of such files can gradually consume process memory.

What is the practical impact of repeated exploitation?

The leak can cause a gradual increase in process memory use. Repeated triggering may lead to reduced availability as process memory is consumed.

CVE-2026-116152: ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the leak?

What is the practical impact of repeated exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the leak?

What is the practical impact of repeated exploitation?