CVE-2026-109270: ImageMagick before 7.1.2-32 Memory Leak via -process Option
ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to gradually exhaust memory and degrade service availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.1.43+dfsg1-1+deb13u14 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-32
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low-level privileges to invoke ImageMagick with the -process option. The available information does not indicate that remote, unauthenticated access alone is sufficient.
What is the operational impact of repeated exploitation?
Repeated invocations using crafted -process arguments can leave memory allocations unreleased. Over time, this can exhaust available memory and degrade service availability.
Which installations should be prioritized for remediation?
ImageMagick versions before 7.1.2-32 are affected. Prioritize systems where low-privileged users or automated local workloads can run ImageMagick commands with attacker-controlled arguments.