CVE-2026-109270
Received Received - Intake

Memory Leak in ImageMagick via -process Option

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to gradually exhaust memory and degrade service availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109270
EUVD
EUVD-2026-97714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in ImageMagick versions before 7.1.2-32. It occurs in the -process option where memory allocated for command-line arguments is not properly freed. Attackers can exploit this by repeatedly using crafted arguments to exhaust system memory, degrading service availability.

Detection Guidance

To detect this vulnerability, check the ImageMagick version installed on your system. Run: convert --version or identify --version. If the version is below 7.1.2-32, the system is vulnerable. Monitor memory usage during ImageMagick operations, especially when using the -process option repeatedly.

Impact Analysis

The impact is primarily on system availability. Repeated exploitation can cause memory exhaustion, leading to degraded performance or crashes. It requires local access and user interaction but no special privileges.

Compliance Impact

This vulnerability primarily impacts service availability due to memory exhaustion, which may indirectly affect compliance with standards like GDPR or HIPAA by degrading system performance or causing service disruptions. However, there is no direct evidence that this vulnerability leads to unauthorized data access or disclosure, which are key concerns for GDPR and HIPAA.

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-32 or later immediately. If upgrading is not possible, restrict access to the -process option and avoid using it with untrusted inputs. Monitor system memory usage for signs of exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart