Executive brief
ImageMagick is a widely used software suite for editing and converting digital images. A flaw in how it handles specific image formats (MIFF) can cause the program to leak memory if a system error occurs during processing. This could potentially allow an attacker to crash the application or slow down the system, leading to a denial of service.
Technical details
A memory leak vulnerability (CWE-401) exists in the MIFF encoder of ImageMagick. The issue is triggered when a memory allocation failure occurs during the processing of MIFF images, where the software fails to properly release previously allocated memory. This is a local attack vector with high complexity, as it requires specific conditions to trigger the allocation failure. An attacker could exploit this to cause resource exhaustion and a subsequent denial of service (DoS). The vulnerability is addressed in versions 7.1.2-26 and 6.9.13-51.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD