CVE-2026-109261: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder

Q: Which ImageMagick versions require remediation?

ImageMagick 6 releases before 6.9.13-57 are affected. ImageMagick 7 releases before 7.1.2-32 are affected.

Q: Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network-based exploitation with no privileges required and no user interaction, although exploitation has high attack complexity.

Q: What is the expected security impact?

The impact is limited to availability degradation. The CVSS vector indicates no confidentiality or integrity impact and a low availability impact.

Published Oct 12, 2026

Updated

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.

Affected Software

15 affected componentsFixes available

ImageMagick ImageMagick<6.9.13-57, <7.1.2-32

ImageMagick ImageMagick<6.9.13-57

ImageMagick ImageMagick>=7.0.0-0<7.1.2-32

debian/imagemagick<8:6.9.11.60+dfsg-1.6+deb12u14

8:6.9.11.60+dfsg-1.6+deb12u14

debian/imagemagick<8:7.1.1.43+dfsg1-1+deb13u13

8:7.1.1.43+dfsg1-1+deb13u13

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

ubuntu/imagemagick*

debian/imagemagick<=8:6.9.11.60+dfsg-1.6+deb12u11, <=8:7.1.1.43+dfsg1-1+deb13u12

8:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u148:7.1.2.34+dfsg1-18:7.1.2.35+dfsg1-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u14
Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.1.43+dfsg1-1+deb13u13
Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1
Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-57
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-32

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Nov 5, 2026

Data Sourced

via OSV·11:45 AM

Affected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6593

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4858-1

Frequently Asked Questions

Which ImageMagick versions require remediation?

ImageMagick 6 releases before 6.9.13-57 are affected. ImageMagick 7 releases before 7.1.2-32 are affected.

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network-based exploitation with no privileges required and no user interaction, although exploitation has high attack complexity.

What is the expected security impact?

The impact is limited to availability degradation. The CVSS vector indicates no confidentiality or integrity impact and a low availability impact.

CVE-2026-109261: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Which ImageMagick versions require remediation?

Does exploitation require authentication or user interaction?

What is the expected security impact?

Company

Resources

Contact