Executive brief
ImageMagick is a widely used software suite for editing and converting digital images. A flaw in how it handles certain TIFF image files can cause the software to consume excessive memory without releasing it. While this is unlikely to lead to a data breach, it could potentially slow down or crash systems that process untrusted image files.
Technical details
A memory leak (CWE-401) exists in the TIFF encoder of ImageMagick. The vulnerability is triggered when a malformed 'tiff:tile-geometry' parameter is specified, causing the application to fail to release allocated memory. Exploitation requires a local attacker to convince a user to process a specially crafted file (User Interaction) under specific conditions (High Complexity). This can lead to a denial-of-service condition through memory exhaustion. The issue is resolved in versions 7.1.2-26 and 6.9.13-51.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date