UpHeron
All vulnerabilities

Servers and applications

CVE-2026-109261

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder

Severity
Medium 6.3
Published
12 Oct 2026
Last changed
3 Nov 2026
Added to UpHeron
3 Nov 2026
Fixed in
6.9.13-57, 7.1.2-32
Sources
NVD, CVE Program

Description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.

Affected software

SoftwareAffected versions
ImageMagickServers and applications · cna:imagemagick|imagemagick
  • Every version before 6.9.13-57
  • From 7.0.0-0 before 7.1.2-32
ImageMagickServers and applications · cpe:a:imagemagick:imagemagick
  • Every version before 6.9.13-57
  • From 7.0.0-0 before 7.1.2-32

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-109261
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-109261