ImageMagick CVE-2026-109278

Exploitation requires the target to invoke ImageMagick's wavelet-denoise operation (e.g. -wavelet-denoise / WaveletDenoiseImage) on attacker-influenced input, AND the host must be in a resource-constrained state such that an internal memory allocation fails - that failure path is exactly what leaks the noise image buffer. LIMITING FACTORS: the leak only occurs on the allocation-failure branch (reflected by CVSS AT:P), so a well-resourced host may never trigger it; impact is limited to gradual availability degradation requiring many repeated requests (no single-shot crash, no code execution, no data exposure). Versions before 6.9.13-57 (6.x) and 7.x before 7.1.2-32 are affected.

This is a genuinely medium/low-priority availability issue, not a critical one. The CVSS 4.0 base score is 6.3 but the vector tells the real story: VC:N/VI:N (no confidentiality or integrity impact) with only VA:L (low availability impact), and crucially AT:P - exploitation has a specific attack requirement, namely that the system must already be under resource-constrained conditions so that a memory allocation fails. CWE-401 (missing memory release) and the source diff confirm the impact is a resource leak that degrades availability over repeated triggering, not data exposure. No EPSS score, KEV listing, or public POC was provided in the input, and there is no indication of active exploitation; VulnCheck reported/triaged the flaw but that is advisory research, not exploit code. NOTE A CLEAR CONFLICT: the input Tag 'Information Disclosure' contradicts both the CWE (memory leak) and the CVSS metrics (VC:N - zero confidentiality impact); this is a denial-of-service/availability bug, and the tag appears mislabeled. Bottom line: a slow availability-degradation DoS requiring an already-stressed system and repeated attacker-controlled wavelet-denoise processing - patch during normal maintenance, not an emergency.

An attacker repeatedly submits images to a service that invokes ImageMagick's wavelet-denoise operation while the host is under memory pressure, so that an internal allocation fails on each call. Because the failed-allocation path does not free the already-allocated noise image, each attempt leaks memory, gradually exhausting resources and degrading or disrupting the service. No public exploit code was identified at time of analysis; the attack is a repetition-based resource-exhaustion rather than a single deterministic crash.