Executive brief
ImageMagick is a widely-used image processing library. A memory leak vulnerability in its MSL (Magick Scripting Language) image decoder allows attackers to craft malicious images that consume system memory without releasing it, potentially exhausting available memory and causing the application or server to become unavailable.
Technical details
This vulnerability is a memory leak (CWE-401 / CWE-400) in the MSL image decoder component of ImageMagick. When a specially crafted MSL image is processed, memory is allocated during image decoding but not properly released, causing memory consumption to grow unbounded. The attack requires network access to supply a crafted image file, with high attack complexity; no authentication or user interaction is needed. An attacker can trigger a denial of service by exhausting memory. Patches are available in ImageMagick 7.1.2-30 and 6.9.13-55.
Affected products
- ImageMagick ImageMagick before 7.1.2-30 and before 6.9.13-55
Timeline
- 2026-08-23: disclosed: GitHub Security Advisory published
- 2026-09-07: other: NVD record published
- 2026-08-23: patched: Patches available in versions 7.1.2-30 and 6.9.13-55