CVE-2026-109278
Received Received - Intake

Memory Leak in ImageMagick via Wavelet-Denoise Operation

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109278
EUVD
EUVD-2026-97580

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109278 is a memory leak vulnerability in ImageMagick's wavelet-denoise operation. When the system fails to acquire required resources, the operation does not release allocated memory properly. Attackers can repeatedly trigger this operation under constrained conditions to cause memory leaks, degrading service availability.

Detection Guidance

To detect this vulnerability, check the ImageMagick version installed on your system. Run: convert --version or identify --version. If the output shows versions before 6.9.13-57 or 7.x before 7.1.2-32, the system is vulnerable. Monitor for memory leaks during wavelet-denoise operations by checking system memory usage with tools like top, htop, or ps while processing images.

Impact Analysis

This vulnerability can lead to degraded service availability due to memory exhaustion. It may cause system slowdowns or crashes if exploited repeatedly under resource-constrained conditions. The impact is limited to reduced availability of the affected component.

Mitigation Strategies

Immediately update ImageMagick to version 6.9.13-57 or later, or 7.1.2-32 or later. Disable wavelet-denoise operations if not required. Restrict access to ImageMagick processing to trusted users only. Monitor system memory usage for signs of leaks and apply patches from the official ImageMagick repository.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart