CVE-2026-109261

HighCVSS 7.5/10Last modified Nov 3, 2026

Description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
ImageMagickImageMagick>= 7.0.0-0, < 7.1.2-32
ImageMagickImageMagick< 6.9.13-57

References

Timeline

Published
Oct 12, 2026
Last modified
Nov 3, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1092627.5ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocatCVE-2026-1092637.5ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory whenCVE-2026-1092643.7ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. CVE-2026-1092655.3ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory dueCVE-2026-1092663.6ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escCVE-2026-1092675.5ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that faCVE-2026-1092687.5ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images withCVE-2026-1092695.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a CVE-2026-109278.3Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potCVE-2026-1092703.3ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allCVE-2026-1092713.7ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation failCVE-2026-1092723.7ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is
CVE-2026-109261: High severity, CVSS 7.5 | Vulnix