{"id":"CVE-2026-116146","aliases":[],"cve":{"records":[{"id":"CVE-2026-116146","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-25T12:21:59.039Z","published":"2026-10-25T13:19:56.440Z","modified":"2026-10-26T19:58:39.647Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-25T13:19:56.440Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T19:58:39.647Z"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j657-rmv3-4m94","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-in-msl-decoder","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-401","description":"Missing Release of Memory after Effective Lifetime","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0-0","versionEndExcluding":"7.1.2-33"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9.13-58"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T19:41:56.204542Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service.","score":6.3,"severity":"medium","published":"2026-10-25T13:19:56.440Z","modified":"2026-10-26T19:58:39.647Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"ImageMagick","name":"ImageMagick","platforms":[],"versions":[{"version":"7.0.0-0","status":"affected","lessThan":"7.1.2-33","versionType":"custom"},{"version":"7.1.2-33","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-116146"},{"vendor":"ImageMagick","name":"ImageMagick","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"6.9.13-58","versionType":"custom"},{"version":"6.9.13-58","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-116146"}],"remediation":[],"references":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j657-rmv3-4m94","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-in-msl-decoder"],"sources":[{"name":"CVE","id":"CVE-2026-116146","modified":"2026-10-26T19:58:39.647Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116146"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7}],"sourceAffected":[],"observedAt":"2026-10-29T14:34:50.880Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T12:15:32.680Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 has a memory leak in the MSL decoder, allowing attackers to cause resource exhaustion and denial of service by supplying crafted MSL files. The weakness is due to missing release of memory after effective lifetime. Affected versions include 7.0.0-0 to 7.1.2-33 and before 6.9.13-58.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:12:35.400Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-116146"}]}}