EUVD-2026-109417
GHSA-h562-79rh-542j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted image to processing workflow
-
DeliveryInvoke ImageMagick with -set profile
-
ExploitTrigger missing cleanup / memory leak
-
ExecutionRepeat to exhaust memory
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires that ImageMagick be used with the -set profile option to process an attacker-influenced image; the leak occurs on that specific code path. Per the CVSS 4.0 vector this is a local vector (AV:L) requiring passive user interaction (UI:P) - a user or automated job must be induced to process the crafted input - with no privileges needed (PR:N). Limiting factors: impact is confined to availability (VA:L, no confidentiality or integrity impact); a single invocation only leaks memory rather than crashing, so meaningful DoS requires repeated processing to exhaust resources; and workflows that do not use the -set profile option are not affected. |
| Impact | This is a low-to-moderate severity resource-exhaustion issue, not an urgent priority. The CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:P/VC:N/VI:N/VA:L) describes a local attack vector requiring passive user interaction, with no confidentiality or integrity impact and only LOW availability impact - consistent with a CWE-401 memory leak rather than a code-execution flaw. No EPSS score was provided, the CVE is not listed in CISA KEV, and no exploit code is referenced (only the GHSA vendor advisory and the VulnCheck advisory), so there is no public exploit identified at time of analysis. The vuln.today Decision label is 'this_month', which aligns with the modest technical impact: a memory leak that must be triggered repeatedly to exhaust resources, not a one-shot crash. The only mild tension is that AV:L (local) combined with the description's framing of 'an attacker who induces a user to process images' implies an attacker-supplied-file / operator-driven scenario rather than remote network reachability - verify deployment context, because an ImageMagick instance exposed behind a web upload pipeline changes the practical exposure even though the base metric is AV:L. |
| Exploit ScenarioDerived | An attacker supplies a crafted image (or induces a user/automated pipeline) to be processed by ImageMagick with the -set profile option. Each such invocation leaks memory that is never freed; repeated processing gradually exhausts available memory and degrades or crashes the processing service, producing a denial of service. No public exploit code is referenced, and successful abuse depends on the target actually using the -set profile option. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 25, 2026
A missing memory release in ImageMagick's -set profile handling causes each invocation that touches that code path to leak memory, which can degrade or exhaust resources on hosts that repeatedly process attacker-influenced images. The flaw affects 6.x builds before 6.9.13-58 and 7.x builds before 7.1.2-33; exploitation requires a user or automated job to be induced to process a crafted image with the -set profile option, giving a local vector with passive user interaction and no privileges required. Impact is confined to availability - a single run leaks rather than crashes, so a meaningful denial of service needs repeated processing - and no public exploit was identified at time of analysis.
RemediationAI
Upgrade to ImageMagick 6.9.13-58 or 7.1.2-33 respectively, the versions named in the vendor advisory (GHSA-7r5g-p7ff-jgcp, https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7r5g-p7ff-jgcp); patch availability is confirmed by the vendor and by VulnCheck. Note that 6.x and 7.x are separate release branches, so hosts pinned to the legacy 6.x line must move to 6.9.13-58 rather than assuming a 7.x upgrade path. Per the assessed exploitation conditions, processing pipelines that never pass the -set profile option are not on the affected code path, so removing or refusing that option for untrusted input eliminates exposure until the upgrade lands - at the cost of losing profile attach/strip functionality for those workflows. Because the defect is a per-invocation leak that only becomes a denial of service after repeated processing, capping process memory or recycling long-lived worker processes provides interim containment, with the trade-off that legitimate large-image conversions may be killed or slowed; the vendor fix remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ImageMagick is a widely deployed image conversion and processing toolkit used both as a CLI (magick/convert) and as a library embedded in web upload pipelines, thumbnailers, and document converters. The -set profile option attaches, replaces, or clears embedded metadata blocks such as ICC colour profiles and EXIF/IPTC data on an image; the underlying defect is CWE-401 (Missing Release of Memory after Effective Lifetime), meaning a buffer allocated while handling the profile assignment is never freed when the option is used. Because the leak is per-invocation and does not corrupt state, the failure mode is gradual resource consumption rather than a crash. CPE data (cpe:2.3:a:imagemagick:imagemagick) confirms the affected package spans the 6.x and 7.x branches, with the vendor's GitHub advisory recording fixes at 6.9.13-58 and 7.1.2-33. Beyond the fact that the -set profile option is required to reach the leaked allocation, the sources do not describe the precise triggering input or profile payload.
Know when Imagemagick gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Local operator/file-driven trigger (AV:L) needing a user to process the image (UI:R), no privileges (PR:N); memory leak yields only limited availability impact (A:L), no C/I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Exploit-DB