ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng… (CVE-2026-109260)

ImageMagick versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32 contain a memory leak in the PNG encoder component. Specifically, when libpng initialization fails during PNG encoding operations, the allocated memory is not properly freed. An attacker capable of repeatedly causing such failures can exhaust available memory resources, leading to a denial of service condition. The CVSS v3.1 base score is 3.7, reflecting a network attack vector with high attack complexity and no privileges or user interaction required. There is no known exploitation in the wild and no confidentiality or integrity impact.

The vulnerability can lead to denial of service by exhausting memory through repeated failed PNG encoding attempts. There is no impact on confidentiality or integrity. The attack requires network access and has high complexity, limiting ease of exploitation.

A fix is available in ImageMagick versions 6.9.13-57 and 7.1.2-32 and later. Users should upgrade to these or newer versions to remediate the memory leak. Patch status is confirmed by the version boundaries stated in the description. No additional mitigations are indicated.