---
id: CVE-2026-109261
title: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in
  the GIF encoder because allocated memory is not released when color
  quantization fails during encoding
summary: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in
  the GIF encoder because allocated memory is not released when color
  quantization fails during encoding. Attackers can supply images whose GIF
  conversion cause…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-401
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:17.883'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109261'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.180Z'
---

## Overview

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.