{"id":"CVE-2026-109260","title":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in whi…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-401"],"published":"2026-10-12","updated":"2026-10-12","sourceUpdated":"2026-10-12T17:17:17.730","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","references":[{"url":"https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-10-12T18:00:08.179Z","slug":"CVE-2026-109260","body":"## Overview\n\nImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}