ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated… (CVE-2026-109262)

ImageMagick versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32 contain a memory leak in the SVG encoder component (WriteSVGImage). When processing specially crafted SVG image files, the encoder fails to free allocated memory, resulting in a memory leak. This can be exploited by attackers supplying malicious images to cause resource consumption and denial of service conditions.

The vulnerability allows an attacker to cause a denial of service by exhausting system memory through crafted SVG images processed by the vulnerable ImageMagick versions. There is no impact on confidentiality or integrity, only availability is affected.

The vulnerability affects ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32. Users should upgrade to version 6.9.13-57 or later, or 7.1.2-32 or later, where this memory leak has been fixed. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for the official fix and remediation guidance.