EUVD-2026-44616
GHSA-mfm8-5jqr-jw5c
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector for process-level TIFF submission; high complexity for engineering allocation failures; no confidentiality or integrity impact, only low availability.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.
AnalysisAI
Memory leak in ImageMagick's TIFF encoder before version 7.1.2-26 enables denial of service via controlled memory allocation failures. An attacker who can submit TIFF images for processing can repeatedly trigger allocation failures, causing the encoder to leak memory without releasing it, ultimately exhausting available system memory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 2.1 reflects the constrained local attack vector and low availability impact.
Technical ContextAI
ImageMagick (CPE: cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*) is a widely deployed image processing suite used across web applications, CMS platforms, and server pipelines. The vulnerability resides in the TIFF encoder component, which handles conversion to and from Tagged Image File Format. CWE-401 (Missing Release of Memory after Effective Lifetime) describes the root cause: when a dynamic memory allocation call fails during TIFF encoding, the error path does not properly free memory already allocated in that request cycle. Repeated invocation of this failure path accumulates unreleased memory. The CVSS 4.0 attack requirement metric AT:P (Present) captures that a specific system condition - allocator failure - must be induced, raising the practical difficulty above a trivially reproducible scenario.
RemediationAI
Upgrade ImageMagick to version 7.1.2-26 or later, which contains the fix for the TIFF encoder memory leak. The upstream advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jfq9-q63x-rc63 should be consulted for release confirmation. For systems where immediate patching is not possible, restricting or disabling TIFF input processing is the most targeted compensating control - this can be achieved by editing ImageMagick's policy.xml to deny the TIFF coder (e.g., adding a policy element with pattern 'TIFF' and rights 'none'), which prevents TIFF files from being processed but will break any workflows depending on TIFF input. Alternatively, deploying resource limits via ImageMagick's policy.xml (memory, disk, and time limits) can cap the blast radius of a memory exhaustion attempt, though this does not eliminate the leak itself. Rate-limiting or sandboxing the ImageMagick process (e.g., via systemd resource controls or container memory limits) provides an additional layer to prevent system-wide impact.
More in Imagemagick
View allReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today