CVE-2026-109260

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32

Description A memory leak exists in the PNG encoder that occurs when libpng initialization fails, preventing the release of allocated memory. An attacker can cause a denial of service by repeatedly triggering PNG encoding operations that result in libpng initialization failure, leading to memory exhaustion.

Recommendations Update to version 6.9.13-57 or later. Update to version 7.1.2-32 or later.