Executive brief
ImageMagick, a widely used software suite for editing and converting images, is affected by a memory management flaw in its VIFF image encoder. By providing a specially crafted image file, an attacker could cause the software to leak memory, potentially leading to a system slowdown or crash. This impact is generally limited to a denial-of-service condition on the machine processing the image.
Technical details
A memory leak vulnerability (CWE-401) exists in ImageMagick's VIFF encoder. The flaw occurs when a memory allocation failure is encountered during the encoding process, resulting in the software failing to release previously allocated memory. An attacker can exploit this by providing a specially crafted VIFF image designed to trigger these allocation failures. Successful exploitation leads to gradual memory exhaustion and a local denial-of-service (DoS) condition. The vulnerability is addressed in versions 7.1.2-26 and 6.9.13-51.
Affected products
- ImageMagick ImageMagick < 7.1.2-26
- ImageMagick ImageMagick < 6.9.13-51
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-11: disclosed: CVE published to NVD