CVE-2026-109260GHSA-hvwf-wmm6-hvc3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder
ImageMagick ImageMagickLibraries & packages
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.
Text from CVE List
Affected versions 4
- ImageMagickaffected: 7.0.0-0 before 7.1.2-32CVE List
- ImageMagickunaffected: 7.1.2-32CVE List
- ImageMagickaffected: all versions before 6.9.13-57CVE List
- ImageMagickunaffected: 6.9.13-57CVE List
References 4
- github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930Fixvia CVE List
- github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090Fixvia CVE List
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3Advisoryvia CVE List
- vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoderAdvisoryvia CVE List