---
id: CVE-2026-109260
title: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in
  the PNG encoder, which does not release allocated memory when libpng
  initialization fails
summary: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in
  the PNG encoder, which does not release allocated memory when libpng
  initialization fails. Attackers who can repeatedly trigger PNG encoding
  operations in whi…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-401
vendor: ImageMagick
product: ImageMagick
affected:
  - ImageMagick >= 7.0.0-0 < 7.1.2-32
  - ImageMagick < 6.9.13-57
published: '2026-10-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T15:55:45.630'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109260'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00366
epssPercentile: 0.30307
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T18:18:05.374481Z'
ingestedAt: '2026-10-12T18:00:08.179Z'
---

## Overview

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.