EUVD-2026-43189
GHSA-fhrj-r6ww-vq67
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with high complexity to trigger allocator failure; no privileges needed; only low availability impact with no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
AnalysisAI
Memory exhaustion denial of service in ImageMagick before 7.1.2-26 results from an unreleased memory leak in the VIFF image encoder triggered by failed memory allocation during image processing. Locally-positioned attackers without privileges can supply specially crafted VIFF images to repeatedly trigger this leak, gradually exhausting system memory. The CVSS 4.0 score of 2.1 with local attack vector, high complexity, and additional prerequisites indicates this is a low-severity, operationally limited issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
ImageMagick (CPE: cpe:2.3:a:imagemagick:imagemagick) is a widely-used open-source image processing suite and library used across web applications, CMSes, and server pipelines. The vulnerability resides in the VIFF (Visualization Image File Format) encoder - a codec handling a legacy scientific image format. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): when internal memory allocation fails during VIFF encoding, the code path does not properly free previously allocated buffers before returning an error, leaving those buffers unreachable and unreclaimed. By repeatedly submitting crafted VIFF images engineered to induce allocation failures - for example, images with parameters that push the allocator toward failure thresholds - an attacker can accumulate leaked memory across multiple invocations until system memory is exhausted. All ImageMagick versions before 7.1.2-26 are affected per the CPE and GitHub security advisory GHSA-m596-67p7-69wh.
RemediationAI
Vendor-released patch: ImageMagick 7.1.2-26. Upgrade to version 7.1.2-26 or later as the primary and preferred remediation, following guidance in the GitHub Security Advisory GHSA-m596-67p7-69wh (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh). Where immediate upgrading is not feasible, operators can disable VIFF format support in ImageMagick by adding 'VIFF' to the disabled coders list in the ImageMagick policy.xml file (e.g., adding a policy element with domain 'coder' and rights 'none' for pattern 'VIFF'), which will prevent the vulnerable encoder from being invoked entirely - this is a low-impact workaround as VIFF is a legacy scientific format rarely required in modern deployments. Additionally, for server-side image processing pipelines, restrict accepted file types at the application layer to exclude VIFF uploads as a defense-in-depth measure. Setting resource limits in ImageMagick policy.xml (e.g., memory, map, and disk limits) can also cap the maximum memory a single invocation can consume, bounding the DoS impact even if the leak is triggered.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today