CVE-2026-109261: imagemagick imagemagick

CVSS 7.5 (high) · published 2026-10-12

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.

Affected products (NVD): imagemagick imagemagick

Fixed in (NVD): 6.9.13-57, 7.1.2-32

Weakness: CWE-401

Source: NVD CVE-2026-109261

References

• https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4
• https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b
• https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.