ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).
CVSS Details
- CVSS 4.0 Base Score: 6.3 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade ImageMagick-debuginfoUpgrade ImageMagick-c++Upgrade ImageMagick-debugsourceUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-c++-develUpgrade ImageMagick-libs-debuginfoUpgrade ImageMagick-c++-debuginfoUpgrade ImageMagickUpgrade ImageMagick-perl-debuginfoUpgrade ImageMagick-docUpgrade ImageMagick-libs | Sep 30, 2026 | Jul 15, 2026 |
| Debian | — | Upgrade imagemagick | Jul 26, 2026 | Jul 26, 2026 |
| Redhat_linux | — | No solution exists | Jul 20, 2026 | Jul 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub