CVE-2026-109262: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-57 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-32
Event History
Frequently Asked Questions
Which deployments are affected?
ImageMagick versions earlier than 6.9.13-57 are affected in the 6.x line, and versions earlier than 7.1.2-32 are affected in the 7.x line. The issue is specifically in the SVG encoder's WriteSVGImage path.
What must an attacker be able to do to exploit this issue?
An attacker must be able to supply a crafted image that the vulnerable ImageMagick installation processes using the SVG encoder. No authentication or user interaction is required according to the supplied severity vector.
What is the practical impact?
Repeated processing of crafted images can leak allocated memory and consume resources, resulting in denial of service. The provided impact data identifies availability impact only, with no stated confidentiality or integrity impact.
What can be done if an immediate upgrade is not possible?
The provided information supports limiting or preventing processing of untrusted images through the SVG encoder until an updated version can be deployed. This reduces exposure to crafted inputs reaching the vulnerable WriteSVGImage code path.