CVE-2026-109278

3.7Low

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

3.7Low

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-401

Impact

Remote attackers can degrade service availability by triggering memory exhaustion through repeated image processing requests. They need network access to an endpoint that exposes ImageMagick's wavelet-denoise function under resource-constrained conditions.

Root cause

The wavelet-denoise operation fails to free allocated memory if acquiring a required resource fails during execution.

Affected systems

ImageMagick versions prior to 6.9.13-57 and 7.x versions prior to 7.1.2-32

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade ImageMagick to 6.9.13-57, 7.1.2-32, or later. If patching immediately is not possible, disable or restrict untrusted inputs to the wavelet-denoise operation in your application workflow.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109278