Description

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-07T13:20:40.963Z",
  "pubdate": "2026-09-07T13:20:40.963Z",
  "executiveSummary": "A memory leak vulnerability exists within the ImageMagick MSL (Magick Scripting Language) image decoder, affecting versions prior to 7.1.2-30 and 6.9.13-55.\nThe vulnerability allows an unauthenticated, remote attacker to trigger an uncontrolled memory consumption state by submitting a specially crafted MSL file.\nThis flaw resides in the handling of image processing instructions where memory is allocated for specific operations but is not properly released upon completion or during error handling routines.\nThe primary impact is a Denial of Service (DoS) resulting from resource exhaustion, which can lead to service instability or process termination when the system reaches its memory limits.\nSuccessful exploitation does not necessarily require high-level privileges but necessitates the ability to submit an MSL file for processing by the ImageMagick utility.\nOrganizations relying on ImageMagick for automated image processing tasks are at risk if they process untrusted or user-supplied MSL files without strict input validation or sandboxing.",
  "technicalDetails": "The vulnerability is rooted in the MSL (Magick Scripting Language) decoder component of ImageMagick. MSL is an XML-based scripting language that allows users to perform complex image processing operations via an interpreter within the ImageMagick library.\nThe root cause of the memory leak involves an error in the memory management lifecycle during the execution of specific MSL tags. When the decoder processes these tags, it allocates heap memory to store intermediate image buffers or metadata structures. In instances involving malformed or crafted MSL inputs, the control flow fails to reach the designated deallocation routine—specifically failing to call the appropriate free or image destruction functions—causing these memory blocks to remain allocated for the duration of the process lifecycle.\nThe exploitation flow begins with the attacker constructing a malicious MSL file designed to repeatedly invoke the vulnerable memory-allocating operations. When this file is processed by a vulnerable version of ImageMagick, the decoder encounters the crafted instructions, resulting in an incremental increase in the process's Resident Set Size (RSS).\nBecause this is an iterative leak, an attacker can intentionally increase the memory footprint of the ImageMagick process by submitting a file that triggers the leak thousands of times in a single execution or by sending a stream of such requests to an application that processes images on demand.\nAs the process consumes increasing amounts of system memory, the environment will eventually reach a state of memory exhaustion. If the host system is not configured with strict resource limits (such as cgroups or ulimit), this can lead to system-wide instability or trigger the OOM (Out of Memory) Killer, resulting in the termination of the ImageMagick process and potentially impacting other services running on the same host.\nThis vulnerability does not require authentication, as the attack vector is limited to the ingestion of a malicious file. No special privileges are required by the attacker beyond the capability to upload or submit an image file for processing. There is no evidence of arbitrary code execution; however, the state of resource exhaustion provides a high-reliability DoS vector against web servers, batch processing pipelines, or image conversion microservices."
}