Junglewise Threat Intelligence

ImageMagick memory leak in TIFF encoder

Severity: low · CVSS 2.9 · Published 2026-07-24

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), ImageMagick, Dlemstra Magick.NET, Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: NuGet, ImageMagick, Dlemstra.

Executive brief

ImageMagick is a widely used software suite for creating, editing, and converting images. A flaw in how it handles TIFF image files can lead to a small memory leak if a memory allocation fails during processing. While the impact is low, repeated exploitation could theoretically lead to a gradual decrease in available system memory, potentially affecting performance or stability over time.

Technical details

A memory leak (CWE-401) exists in the ImageMagick TIFF encoder. The vulnerability is triggered when a memory allocation fails within the encoder, causing the application to fail to release previously allocated memory. This is a local vulnerability with high attack complexity, as it requires the attacker to influence memory allocation success. An attacker could potentially cause a minor denial-of-service condition through memory exhaustion if the leak is triggered repeatedly. The issue is fixed in ImageMagick version 7.1.2-26 and Magick.NET version 14.15.0.

Affected products

  • ImageMagick ImageMagick < 7.1.2-26
  • dlemstra Magick.NET < 14.15.0

Timeline

  • 2026-06-26: disclosed
  • 2026-06-26: patched: ImageMagick 7.1.2-26 released
  • 2026-07-12: patched: Magick.NET 14.15.0 released
  • 2026-07-24: advisory

References

Related threats