Executive brief
ImageMagick is a widely used open-source tool for creating, editing, and converting digital images. A flaw in how it handles specific image formats can cause the software to consume system memory without releasing it. If exploited repeatedly, this could lead to performance degradation or service outages for applications that process user-uploaded images.
Technical details
A memory leak (CWE-401) exists in ImageMagick's `coders/ashlar.c` component. The `WriteASHLARImage` function allocates a structure that is not properly released when an exception is thrown during processing. An attacker could potentially trigger this leak by providing a specially crafted image that causes an exception, leading to gradual memory exhaustion. The vulnerability is reachable over the network if the library is used in a web-facing application to process images. The issue is resolved in version 7.1.2-15.
Affected products
- ImageMagick ImageMagick < 7.1.2-15
Timeline
- 2026-02-23: advisory: GitHub Security Advisory published
- 2026-02-24: disclosed: NVD publication date
- 2026-02-23: patched: Version 7.1.2-15 released with fix