Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing raster image files. A flaw in its VIFF image format encoder can cause a memory leak if a system resource allocation fails during processing. While this is a low-severity issue, it could theoretically contribute to system instability or performance degradation if the software is repeatedly triggered to process malformed or complex files under low-memory conditions.
Technical details
A memory leak vulnerability (CWE-401) exists in ImageMagick's VIFF encoder. The issue occurs when the encoder fails to properly release previously allocated memory after a subsequent allocation request fails. This is a local vulnerability with high attack complexity, as it requires the attacker to influence the environment to trigger an allocation failure during the encoding process. Exploitation results in a minor impact on availability due to gradual memory exhaustion. The issue is addressed in ImageMagick versions 7.1.2-26 and 6.9.13-51, as well as Magick.NET 14.15.0.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
- ImageMagick Magick.NET < 14.15.0
Timeline
- 2026-06-26: disclosed
- 2026-07-24: advisory