ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a… (CVE-2026-109263)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder component. When a particular operation within the encoder fails, the allocated memory is not freed, resulting in a memory leak. An attacker can provide specially crafted input to trigger this failure, causing the application to leak memory continuously. This can lead to resource exhaustion and denial of service conditions. The CVSS v3.1 base score is 3.7, reflecting a network attack vector with high attack complexity and no privileges or user interaction required. There is no impact on confidentiality or integrity, only availability.

The vulnerability allows an attacker to cause a denial of service by exhausting system memory through a memory leak in the YUV encoder. There is no impact on data confidentiality or integrity. The attack requires high complexity and no privileges or user interaction, limiting exploitability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted images with vulnerable versions of ImageMagick to mitigate risk.