EUVD-2026-44620
GHSA-3mhh-97mg-5hxp
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only exploitation requiring a non-default malformed parameter and user invocation, causing only low availability impact with no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption.
AnalysisAI
Memory leak in ImageMagick's TIFF encoder - affecting the 7.x branch before 7.1.2-26 and the 6.x branch before 6.9.13-51 - allows an attacker or application to cause gradual memory exhaustion by repeatedly supplying an invalid tiff:tile-geometry parameter during TIFF encoding operations. The flaw scores 2.0 under CVSS 4.0 with only low availability impact, a local attack vector, high complexity, and prerequisite conditions, placing it firmly in the low-severity tier. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at the time of analysis.
Technical ContextAI
The vulnerability resides in ImageMagick's TIFF encoder, which supports tile-based TIFF output configurable via the tiff:tile-geometry define (passed as -define tiff:tile-geometry=WxH on the CLI or via the API). When this parameter is set to an invalid value, the encoder allocates memory for processing but fails to release it upon encountering the malformed input - a textbook CWE-401 (Missing Release of Memory after Effective Lifetime) defect. CPE data (cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*) confirms both the 6.x and 7.x ImageMagick branches are affected, with the fix introduced at 6.9.13-51 and 7.1.2-26 respectively. ImageMagick is a widely deployed open-source image manipulation suite underpinning countless Linux, web, and content-processing workflows.
RemediationAI
The primary fix is upgrading ImageMagick to version 7.1.2-26 or later (7.x users) or 6.9.13-51 or later (6.x users), as confirmed by the upstream advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h5r4-w88w-7ccr. Where immediate upgrading is not feasible, operators should sanitize or reject the tiff:tile-geometry define before it reaches the encoder - stripping or validating this parameter at the application layer prevents malformed values from triggering the leak. Additionally, enforcing per-process memory limits via ImageMagick's policy.xml (setting the memory resource limit, e.g., <policy domain='resource' name='memory' value='256MiB'/>) bounds the worst-case impact of repeated leaks; note this may cause legitimate high-memory operations to fail. Neither workaround eliminates the underlying defect and both require application-level changes.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Same weakness CWE-401 – Memory Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today