CVE-2026-109260
MEDIUM
6,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW
3,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low
Description
AI Translation Available
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.
401
Missing Release of Memory after Effective Lifetime
DraftCommon Consequences
Security Scopes Affected:
Availability
Other
Potential Impacts:
Dos: Crash, Exit, Or Restart
Dos: Instability
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Reduce Performance
Applicable Platforms
Languages:
Not Language-Specific, C, C++
https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7…
https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed75…
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-h…
https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-befor…