CVE-2026-109278

Analyzed Analyzed - Analysis Complete

Memory Leak in ImageMagick via Wavelet-Denoise Operation

Publication date: 2026-10-12

Last updated on: 2026-11-03

Assigner: VulnCheck

Description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-11-03

Generated

2026-11-08

AI Q&A

2026-10-12

EPSS Evaluated

2026-11-07

NVD

CVE-2026-109278

EUVD

EUVD-2026-97580

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-32 (exc)
imagemagick	imagemagick	to 6.9.13-57 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

CVE-2026-109278 is a memory leak vulnerability in ImageMagick's wavelet-denoise operation. When the system fails to acquire required resources, the operation does not release allocated memory properly. Attackers can repeatedly trigger this operation under constrained conditions to cause memory leaks, degrading service availability.

Detection Guidance

To detect this vulnerability, check the ImageMagick version installed on your system. Run: convert --version or identify --version. If the output shows versions before 6.9.13-57 or 7.x before 7.1.2-32, the system is vulnerable. Monitor for memory leaks during wavelet-denoise operations by checking system memory usage with tools like top, htop, or ps while processing images.

Impact Analysis

This vulnerability can lead to degraded service availability due to memory exhaustion. It may cause system slowdowns or crashes if exploited repeatedly under resource-constrained conditions. The impact is limited to reduced availability of the affected component.

Compliance Impact

This vulnerability primarily impacts service availability due to memory leaks during resource-constrained conditions. It does not directly expose or leak sensitive data, which is a key requirement for GDPR and HIPAA compliance. However, degraded service availability could indirectly affect compliance by disrupting systems handling personal or health data.

Mitigation Strategies

Immediately update ImageMagick to version 6.9.13-57 or later, or 7.1.2-32 or later. Disable wavelet-denoise operations if not required. Restrict access to ImageMagick processing to trusted users only. Monitor system memory usage for signs of leaks and apply patches from the official ImageMagick repository.

Hi! I’m here to help you understand CVE-2026-109278. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...