Executive brief
ImageMagick, a widely used software suite for editing and converting images, is affected by a minor memory leak. When the software fails to perform a specific color transformation (log colorspace), it fails to release a small amount of memory. While this is unlikely to cause a major system failure, repeated occurrences could theoretically lead to reduced system performance or a service crash over time.
Technical details
A memory leak vulnerability (CWE-401) exists in ImageMagick's color transformation logic. Specifically, when a transformation to the log colorspace fails, the application does not properly release allocated memory. This is a local vulnerability with high attack complexity, as it requires the attacker to trigger a specific failure condition during image processing. The primary impact is a minor degradation of availability due to resource exhaustion if the failure is triggered repeatedly. The issue is resolved in versions 7.1.2-26 and 6.9.13-51.
Affected products
- ImageMagick ImageMagick < 7.1.2-26
- ImageMagick ImageMagick < 6.9.13-51
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD dataset