Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A flaw in how it handles ICON files can cause the system to leak memory if a specific memory error occurs during processing. An attacker could use a specially crafted image to slowly consume system resources, potentially causing the application to crash or become unresponsive.
Technical details
A memory leak vulnerability (CWE-401) exists in the ICON decoder of ImageMagick versions prior to 7.1.2-26 and 6.9.13-51. The issue is triggered when a memory allocation failure occurs during the decoding process, failing to release previously allocated resources. An attacker can exploit this by providing a specially crafted ICON file designed to trigger these allocation failures. While the attack complexity is high, successful exploitation allows for gradual memory exhaustion, leading to a denial of service (DoS) condition. The issue has been patched in versions 7.1.2-26 and 6.9.13-51.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD dataset