CVE-2026-109270: ImageMagick before 7.1.2-32 Memory Leak via -process Option

Q: Who can exploit this issue?

An attacker needs local access and low-level privileges to invoke ImageMagick with the -process option. The available information does not indicate that remote, unauthenticated access alone is sufficient.

Q: What is the operational impact of repeated exploitation?

Repeated invocations using crafted -process arguments can leave memory allocations unreleased. Over time, this can exhaust available memory and degrade service availability.

Q: Which installations should be prioritized for remediation?

ImageMagick versions before 7.1.2-32 are affected. Prioritize systems where low-privileged users or automated local workloads can run ImageMagick commands with attacker-controlled arguments.

Published Oct 12, 2026

Updated

ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to gradually exhaust memory and degrade service availability.

Affected Software

1 affected component

ImageMagick ImageMagick<7.1.2-32

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-32

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs local access and low-level privileges to invoke ImageMagick with the -process option. The available information does not indicate that remote, unauthenticated access alone is sufficient.

What is the operational impact of repeated exploitation?

Repeated invocations using crafted -process arguments can leave memory allocations unreleased. Over time, this can exhaust available memory and degrade service availability.

Which installations should be prioritized for remediation?

ImageMagick versions before 7.1.2-32 are affected. Prioritize systems where low-privileged users or automated local workloads can run ImageMagick commands with attacker-controlled arguments.

CVE-2026-109270: ImageMagick before 7.1.2-32 Memory Leak via -process Option

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact of repeated exploitation?

Which installations should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact of repeated exploitation?

Which installations should be prioritized for remediation?