---
id: CVE-2026-109260
title: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in
  the PNG encoder, which does not release allocated memory when libpng
  initialization fails
summary: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in
  the PNG encoder, which does not release allocated memory when libpng
  initialization fails. Attackers who can repeatedly trigger PNG encoding
  operations in whi…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-401
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:17.730'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109260'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.179Z'
---

## Overview

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.