Executive brief
ImageMagick, a widely used software for creating and editing images, contains a flaw that can cause it to consume excessive system memory. By providing a specifically crafted image file, an attacker can cause the software to crash or become unresponsive, potentially disrupting services that rely on it for image processing. This could lead to a temporary denial of service for websites or applications that use ImageMagick to handle user-uploaded content.
Technical details
A memory leak vulnerability (CWE-401) exists in ImageMagick's PNG encoder component. The issue occurs specifically when the encoder fails while attempting to write Multiple-image Network Graphics (MNG) files, failing to release previously allocated memory. An attacker can exploit this by triggering specific encoder failure conditions, leading to memory exhaustion and a subsequent Denial of Service (DoS). The attack is reachable over the network but has high complexity as it requires specific failure states during the encoding process. The vulnerability is addressed in versions 7.1.2-19 and 6.9.13-44.
Affected products
- ImageMagick ImageMagick < 7.1.2-19, < 6.9.13-44
Timeline
- 2026-04-13: advisory: Initial GitHub security advisory published
- 2026-06-30: disclosed: NVD publication date