CVE-2026-109262
5.3MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-401
Impact
Remote unauthenticated attackers can cause denial of service via memory exhaustion by submitting crafted images. They need the ability to submit images to any service that converts or writes files using ImageMagick's SVG encoder.
Root cause
The SVG encoder function WriteSVGImage fails to release allocated memory when processing crafted images.
Affected systems
ImageMagick versions before 6.9.13-57 and 7.x versions before 7.1.2-32
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Fix & remediation
Upgrade ImageMagick to 6.9.13-57, 7.1.2-32, or later. If patching immediately is not possible, disable SVG writing by adding <policy domain="coder" rights="none" pattern="SVG" /> to policy.xml.
$ magick -version || convert -versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.
References
- https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp
- https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df
- https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder