ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated… (CVE-2026-109278)

ImageMagick versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32 contain a memory leak vulnerability in the wavelet-denoise operation. The vulnerability occurs because the operation fails to release allocated memory when it cannot acquire a required resource. This can be exploited by an attacker to repeatedly invoke the wavelet-denoise processing under constrained resources, causing memory to leak and potentially degrade the availability of the service.

The vulnerability results in a memory leak that can degrade service availability by exhausting system memory. There is no impact on confidentiality or integrity. The CVSS score is 3.7 (medium severity), reflecting a low complexity attack vector with no privileges or user interaction required, but with high attack complexity due to resource constraints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, limit exposure by restricting access to the wavelet-denoise functionality or applying resource usage controls to mitigate potential memory exhaustion.