Executive brief
ImageMagick is a widely used software suite for creating, editing, and converting images. A flaw in how it handles TIFF image files can lead to a small memory leak if a memory allocation fails during processing. While the impact is low, repeated exploitation could theoretically lead to a gradual decrease in available system memory, potentially affecting performance or stability over time.
Technical details
A memory leak (CWE-401) exists in the ImageMagick TIFF encoder. The vulnerability is triggered when a memory allocation fails within the encoder, causing the application to fail to release previously allocated memory. This is a local vulnerability with high attack complexity, as it requires the attacker to influence memory allocation success. An attacker could potentially cause a minor denial-of-service condition through memory exhaustion if the leak is triggered repeatedly. The issue is fixed in ImageMagick version 7.1.2-26 and Magick.NET version 14.15.0.
Affected products
- ImageMagick ImageMagick < 7.1.2-26
- dlemstra Magick.NET < 14.15.0
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched: ImageMagick 7.1.2-26 released
- 2026-07-12: patched: Magick.NET 14.15.0 released
- 2026-07-24: advisory