CVE-2026-109263: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-57 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-32
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions earlier than 6.9.13-57 or 7.x versions earlier than 7.1.2-32 are affected. The issue is in the YUV encoder.
What does an attacker need to exploit the vulnerability?
An attacker needs to supply crafted input that causes a specific YUV encoder operation to fail. No privileges or user interaction are required, but exploitation has high attack complexity.
What is the likely impact?
Repeated triggering can leak memory and exhaust available resources, resulting in denial of service. The provided severity vector indicates no confidentiality or integrity impact.
What should be done to remediate the issue?
Upgrade ImageMagick 6 to 6.9.13-57 or later, or ImageMagick 7 to 7.1.2-32 or later.