UpHeron
All vulnerabilities

Servers and applications

CVE-2026-109260

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder

Severity
Medium 6.3
Published
12 Oct 2026
Last changed
3 Nov 2026
Added to UpHeron
3 Nov 2026
Fixed in
6.9.13-57, 7.1.2-32
Sources
NVD, CVE Program

Description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.

Affected software

SoftwareAffected versions
ImageMagickServers and applications · cna:imagemagick|imagemagick
  • Every version before 6.9.13-57
  • From 7.0.0-0 before 7.1.2-32
ImageMagickServers and applications · cpe:a:imagemagick:imagemagick
  • Every version before 6.9.13-57
  • From 7.0.0-0 before 7.1.2-32

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-109260
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-109260