CVE-2026-109262: imagemagick imagemagick

CVSS 7.5 (high) · published 2026-10-12

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.

Affected products (NVD): imagemagick imagemagick

Fixed in (NVD): 6.9.13-57, 7.1.2-32

Weakness: CWE-401

Source: NVD CVE-2026-109262

References

• https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp
• https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df
• https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.