ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations… (CVE-2026-109270)

CVE-2026-109270 describes a memory leak vulnerability in ImageMagick prior to version 7.1.2-32. The issue exists in the -process option, where supplying certain crafted arguments causes memory allocations that are not released properly. An attacker with local privileges can repeatedly invoke this option to consume system memory over time, potentially degrading service availability. The CVSS 3.1 vector indicates low attack complexity and privileges required, no user interaction, and impact limited to availability degradation without confidentiality or integrity loss.

The vulnerability allows local attackers to cause a memory leak by repeatedly invoking the -process option with crafted arguments. This can lead to gradual exhaustion of system memory, resulting in degraded availability of the affected service or system. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the ImageMagick -process option to trusted users only to minimize risk of exploitation.