CVE-2026-116146

A flaw was found in ImageMagick. The Magick Scripting Language (MSL) decoder fails to release allocated memory when processing specially crafted MSL files. An attacker could exploit this vulnerability by providing malicious MSL files for processing, resulting in excessive resource consumption and a Denial of Service (DoS).

This vulnerability is rated as Low impact because exploitation requires tricking an application into parsing an untrusted Magick Scripting Language (MSL) file, and standard command-line usage releases all allocated resources when the process terminates. A sustained denial-of-service condition through memory exhaustion would only manifest in long-running services or persistent daemon workflows that repeatedly handle untrusted MSL inputs without restarting the process. Red Hat Enterprise Linux releases are primarily affected through optional or legacy image processing deployments rather than core system daemons.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the MSL decoder in the ImageMagick security policy configuration.

Edit the policy configuration file (such as /etc/ImageMagick/policy.xml or /etc/ImageMagick-6/policy.xml) and add the following rule inside the <policymap> section:

<policy domain="coder" rights="none" pattern="MSL" />

Caveats: Disabling this coder will prevent legitimate Magick Scripting Language (MSL) scripts and image files from being decoded. Any long-running services, daemons, or web applications utilizing ImageMagick libraries must be restarted for configuration changes to take effect.