CVE-2026-109263

HighCVSS 7.5/10Last modified Nov 3, 2026

Description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
ImageMagickImageMagick>= 7.0.0-0, < 7.1.2-32
ImageMagickImageMagick< 6.9.13-57

References

Timeline

Published
Oct 12, 2026
Last modified
Nov 3, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1092643.7ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. CVE-2026-1092655.3ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory dueCVE-2026-1092663.6ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escCVE-2026-1092675.5ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that faCVE-2026-1092687.5ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images withCVE-2026-1092695.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a CVE-2026-109278.3Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potCVE-2026-1092703.3ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allCVE-2026-1092713.7ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation failCVE-2026-1092723.7ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is CVE-2026-1092735.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocCVE-2026-1092742.5ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path securit
CVE-2026-109263: High severity, CVSS 7.5 | Vulnix