CVE-2026-109260
3.7LowPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-401
Impact
Remote attackers can cause a denial of service by exhausting host memory. They need the ability to repeatedly trigger failed PNG encoding operations via your ImageMagick integration.
Root cause
The PNG encoder fails to free allocated memory when libpng initialization encounters an error.
Affected systems
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Fix & remediation
Upgrade ImageMagick to 6.9.13-57, 7.1.2-32, or later. If upgrading immediately is not possible, disable the PNG coder in policy.xml or configure process memory and rate limits to mitigate memory exhaustion.
$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagickAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.
References
- https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3
- https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090
- https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder