Executive brief
ImageMagick, a widely used suite for editing and converting digital images, contains a flaw in how it handles certain video-related image formats (YUV). When the software fails to open a specific type of data block, it fails to release system memory. Over time, repeated failed attempts could lead to increased memory consumption, potentially slowing down or crashing the service responsible for processing images.
Technical details
A memory leak (CWE-401) exists in the YUV decoder of ImageMagick. The vulnerability is triggered when the decoder attempts to open a blob and fails, resulting in allocated memory not being properly released. This issue affects both the core ImageMagick C/C++ library and its .NET wrapper, Magick.NET. An attacker could potentially exploit this over a network by providing malformed or inaccessible data that triggers the failure path, leading to gradual resource exhaustion (Availability impact). The vulnerability is patched in ImageMagick versions 7.1.2-26 and 6.9.13-51, and Magick.NET version 14.15.0.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
- ImageMagick Magick.NET < 14.15.0
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched: Initial patch release for ImageMagick core
- 2026-07-12: patched: Magick.NET 14.15.0 released
- 2026-07-24: advisory