---
id: CVE-2026-109262
title: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in
  the SVG encoder (WriteSVGImage) that fails to release allocated memory when
  handling crafted images
summary: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in
  the SVG encoder (WriteSVGImage) that fails to release allocated memory when
  handling crafted images. Attackers can supply crafted image files that are
  process…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-401
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:18.033'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109262'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.180Z'
---

## Overview

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.