EUVD-2026-44614
GHSA-3w79-77cj-g7x9
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector and high complexity due to specific internal failure trigger required; no confidentiality or integrity impact, only low availability loss from a small unfreed allocation.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memory leak occurs.
AnalysisAI
ImageMagick's hough lines operation leaks a small amount of memory when a specific internal sub-operation fails, affecting the 7.x branch before 7.1.2-26 and the 6.x legacy branch before 6.9.13-51. This CWE-401 flaw is locally exploitable only under high attack complexity with specific prerequisites, producing a low availability impact with no confidentiality or integrity consequence - reflected in the CVSS 4.0 score of 2.1. No public exploit or active exploitation has been identified at time of analysis; this is a low-priority maintenance patch with no realistic threat-actor motivation.
Technical ContextAI
ImageMagick is an open-source image processing library and command-line toolkit used extensively for image conversion, manipulation, and rendering across Linux, macOS, and containerized web stacks. The hough lines operation implements the Hough Transform algorithm for detecting straight lines within images. CWE-401 (Missing Release of Memory after Effective Lifetime) indicates that the error-handling path within this operation fails to free a small heap allocation when a specific internal condition fails - a classic resource cleanup omission in error branches. CPE string cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* confirms both the 7.x and 6.x release branches are within scope. Because the leak is described as 'small' and tied to a failure condition rather than normal execution, it requires crafted or unusual input to trigger consistently.
RemediationAI
Upgrade ImageMagick 7.x installations to version 7.1.2-26 or later, and ImageMagick 6.x installations to version 6.9.13-51 or later, as confirmed by GitHub Security Advisory GHSA-j8rh-v2r8-v94x (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j8rh-v2r8-v94x). If patching cannot be applied immediately, a specific compensating control is to restrict the hough lines coder in ImageMagick's policy.xml by adding a deny rule for the relevant operation, which prevents the vulnerable code path from executing at the cost of disabling Hough Transform line-detection functionality for legitimate workflows. Alternatively, enforcing strict resource limits (memory ceiling) via policy.xml will bound the impact of any leak to a capped allocation rather than unlimited growth. Given the very low severity, this fix is appropriate for inclusion in the next scheduled maintenance window rather than an emergency patch cycle.
More in Imagemagick
View allReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor
Same weakness CWE-401 – Memory Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today