Memory Leak Vulnerability in ImageMagick Software
CVE-2026-109270

4.8MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109270?

The ImageMagick software, prior to version 7.1.2-32, exhibits a memory leak vulnerability when utilizing the -process option. This flaw allows attackers to exploit the software by sending specially crafted arguments that result in unreleased memory allocations. By repeatedly invoking the -process option with these arguments, an attacker can intensify memory consumption, leading to a gradual degradation of service availability and potential denial of service.

Affected Version(s)

ImageMagick 7.0.0-0 < 7.1.2-32

ImageMagick 7.1.2-32

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://github.com/ImageMagick/ImageMagick/commit/da4cfd7...
patch
https://www.vulncheck.com/advisories/imagemagick-before-7...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
.