Executive brief
ImageMagick is a widely used software suite for creating, editing, and converting images. A flaw in its TIFF image processing component can cause a small amount of system memory to be leaked if the software fails to create a temporary file. While the impact is low, repeated occurrences could theoretically lead to reduced system performance or resource exhaustion over time.
Technical details
A memory leak (CWE-401) exists in the ImageMagick TIFF encoder. The vulnerability is triggered when the encoder fails to create a temporary file, resulting in allocated memory not being properly released. Exploitation requires a local attacker to create conditions where temporary file creation fails (high complexity). The impact is limited to a minor loss of availability due to resource consumption. The issue is addressed in ImageMagick versions 7.1.2-26 and 6.9.13-51, and Magick.NET version 14.15.0.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
- dlemstra Magick.NET < 14.15.0
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched: Initial patch release for ImageMagick
- 2026-07-24: advisory