CVE-2026-25638

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

• CWE-401

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjwVendor Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25632EPyT-Flow is a Python package designed for the easy generati…10
• CVE-2026-25633Statamic is a, Laravel + Git powered CMS designed for buildi…4.3
• CVE-2026-25634iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-25635calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM …8.6
• CVE-2026-25636calibre is an e-book manager. In 9.1.0 and earlier, a path t…7.8
• CVE-2026-25637ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-25639Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-2564A security flaw has been discovered in Intelbras VIP 3260 Z …9.2
• CVE-2026-25640Pydantic AI is a Python agent framework for building applica…5.4
• CVE-2026-25641SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…9
• CVE-2026-25642HedgeDoc is an open source, real-time, collaborative, markdo…6.1
• CVE-2026-25643Frigate is a network video recorder (NVR) with realtime loca…9.1