ImageMagick CVE-2026-116146

The target must feed attacker-controlled MSL (Magick Scripting Language) content to ImageMagick's MSL decoder - exploitation is specific to the MSL coder, not arbitrary image uploads. A single file is insufficient: the description states the leak must be triggered repeatedly ('repeatedly leak memory') to reach resource exhaustion, which is consistent with the AC:H/AT:P metrics indicating non-trivial conditions. Limiting factors: many deployments do not expose the MSL coder to untrusted input (MSL is a scripting format, not a typical user-uploaded image type) and may restrict it via security policy, so only configurations that process untrusted MSL through a vulnerable version (<7.1.2-33 or <6.9.13-58) are realistically affected. Impact is limited to availability; there is no confidentiality or integrity exposure.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L) scores 6.3 and tells a consistent story: network-reachable and unauthenticated (PR:N/UI:N), but with high attack complexity plus a present attack requirement (AC:H/AT:P) and only limited availability impact (VA:L) with zero confidentiality or integrity impact - which matches a memory leak (CWE-401) that must be triggered repeatedly to exhaust resources rather than a single clean crash or code-execution bug. There is no CISA KEV listing and no EPSS score in the supplied data, so widespread or automated exploitation is not indicated; exploitation status is best described as no public exploit identified at time of analysis - the two references are a GitHub Security Advisory and a VulnCheck advisory, neither of which is exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the low-impact DoS profile. The one caveat: the AC:H/AT:P metrics indicate exploitation is not trivial, but the available sources do not describe exactly what attacker-uncontrolled condition raises the complexity, so the precise trigger difficulty is unverified. Overall this is a patch-this-month availability issue, not a drop-everything priority.

An attacker identifies an application or service that passes attacker-supplied MSL (Magick Scripting Language) input to ImageMagick for processing, then submits a crafted MSL image repeatedly. Each processing pass leaks allocated memory that is never freed, and sustained submission drives memory consumption up until the host or service exhausts available memory and denies service. No public exploit code is identified at time of analysis; only vendor/advisory references exist.