CVEvulnerability
CVE-2026-109260
6.3 MEDIUM
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-10-12
- Last modified
- 2026-10-15
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 6.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-401
Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.
Related
Weakness · CWE (1)
- CWE-401 Missing Release of Memory after Effective Lifetime weakness
References
- https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930 github.com
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3 github.com
- https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090 github.com
- https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder www.vulncheck.com