Executive brief
ImageMagick, a widely used software suite for displaying and converting images, contains a minor flaw in how it handles TIFF files. Under specific conditions where the system cannot create temporary files, the software fails to release a small amount of memory. While this is unlikely to cause a major outage, repeated occurrences could theoretically lead to a gradual slowdown of the affected system.
Technical details
A memory leak (CWE-401) exists in the TIFF encoder of ImageMagick. The vulnerability is triggered when the application attempts to encode a TIFF image but fails to create a necessary temporary file; in this error path, previously allocated memory is not properly released. The attack complexity is high as it requires a specific local environment state (failure of temporary file creation). An attacker with local access could potentially cause a minor denial-of-service through memory exhaustion over a long period of repeated triggers. The issue is resolved in versions 7.1.2-26 and 6.9.13-51.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date