A memory leak vulnerability (CWE-401) exists in ImageMagick prior to version 7.1.2-26 within the VIFF encoder component. When processing VIFF images, if memory allocation fails, the software does not properly release allocated memory, leading to a leak. Attackers can exploit this by providing crafted VIFF images that trigger allocation failures, resulting in memory exhaustion and denial of service conditions. No known exploits are reported in the wild. The vulnerability has a low severity rating and no CVSS score is provided.

Successful exploitation can cause denial of service by exhausting available memory on the affected system. There is no indication of code execution, privilege escalation, or data disclosure. The impact is limited to service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor vendor communications for updates. Until a fix is available, avoid processing untrusted VIFF images or implement resource limits to mitigate memory exhaustion risks.