Low severity · published Oct 12, 2026
CVE-2026-109260
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
ImageMagick · ImageMagick
7.0.0-0 before 7.1.2-32; before 6.9.13-57 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109260
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109260
vendor-advisory
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3
patch
https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930
patch
https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090
third-party-advisory
https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder
More from ImageMagick
8.4
CVE-2016-3714
ImageMagick Improper Input Validation Vulnerability
5.5
CVE-2016-3715
ImageMagick Arbitrary File Deletion Vulnerability
5.5
CVE-2016-3718
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
9.8
CVE-2026-25986
ImageMagick has a heap buffer overflow in YUV 4:2:2 decoder
9.8
CVE-2026-25983
ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"