Live › vulnerability › CVE-2026-116146
Go to dashboardImageMagick's MSL decoder fails to free memory when it processes a crafted MSL image. An attacker who can get such files processed can repeat the leak until the host runs out of resources and the service stops responding.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Services that run ImageMagick on files supplied by users or other outside parties are the ones exposed, since the attacker needs to get a crafted MSL file processed. Installations that only handle trusted local images, or that do not accept MSL input, face much less risk. The sources do not say whether a default configuration accepts MSL.
No product ranges from the sources yet.
magick -version and compare the reported version against the fixed releases..msl handling or MSL in the accepted formats: unknown.6.9.13-58 or later.7.1.2-33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116146")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.