CVE-2026-109263

3.7Low

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

3.7Low

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-401

Impact

Remote attackers can trigger memory leaks and cause denial of service by exhausting system resources. They only need the ability to submit crafted input to an application that processes images using the YUV encoder.

Root cause

The YUV encoder fails to release allocated memory when an internal operation fails.

Affected systems

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade ImageMagick to 6.9.13-57, 7.1.2-32, or later. If upgrading immediately is not possible, disable the YUV coder via ImageMagick's policy.xml or stop processing untrusted YUV images.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109263