CVE-2026-109260: ImageMagick PNG Encoder DOS Vulnerability

CVE-2026-109260 Overview

CVE-2026-109260 is a memory leak vulnerability in the ImageMagick PNG encoder. The flaw affects ImageMagick versions before 6.9.13-57 and 7.x versions before 7.1.2-32. The encoder fails to release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations that cause libpng initialization failures can exhaust available memory. Sustained exploitation leads to a denial-of-service (DoS) condition on the host process or service that embeds ImageMagick. The weakness is tracked as CWE-401: Missing Release of Memory after Effective Lifetime.

Critical Impact
Repeated PNG encode requests can exhaust process memory and cause denial of service in any application that embeds vulnerable ImageMagick builds.

Affected Products

ImageMagick 6.x before 6.9.13-57
ImageMagick 7.x before 7.1.2-32
Downstream applications and services embedding vulnerable ImageMagick libraries for PNG encoding

Discovery Timeline

2026-10-12 - CVE-2026-109260 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109260

Vulnerability Analysis

The defect resides in coders/png.c, which implements PNG encoding inside ImageMagick. When the encoder calls libpng to allocate a png_struct or png_info structure and that call fails, ImageMagick throws a writer exception without releasing previously allocated ImageInfo and Image structures. Each failed encode attempt leaks memory. An attacker who can submit crafted PNG encoding requests at scale, for example through a web upload or image conversion API, can drive the host process to out-of-memory conditions. The vulnerability does not corrupt memory or disclose data; the impact is limited to availability.

Root Cause

The root cause is an incomplete error-handling path. The original code invoked ThrowWriterException immediately upon detecting a NULL pointer from png_create_write_struct or png_create_info_struct without first calling DestroyImageInfo and DestroyImage on the already-allocated resources. This left heap allocations unreferenced for the lifetime of the process.

Attack Vector

Exploitation requires network-reachable functionality that invokes ImageMagick's PNG writer. The attacker triggers repeated encode operations under conditions that cause libpng initialization to fail, such as resource pressure or crafted inputs. No authentication is required when the hosting service exposes image conversion to anonymous users.

// Patch from coders/png.c - adds cleanup before throwing writer exception
#endif
  if (ping == (png_struct *) NULL)
-    ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    {
+      image_info=DestroyImageInfo(image_info);
+      image=DestroyImage(image);
+      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    }

  ping_info=png_create_info_struct(ping);

  if (ping_info == (png_info *) NULL)
    {
+      image_info=DestroyImageInfo(image_info);
+      image=DestroyImage(image);
      png_destroy_write_struct(&ping,(png_info **) NULL);
      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
    }

Source: ImageMagick patch commit fd1b9c85 and ImageMagick6 patch commit 55346382. The patch invokes DestroyImageInfo and DestroyImage before throwing the writer exception, releasing resources on the failure path.

Detection Methods for CVE-2026-109260

Indicators of Compromise

Steadily growing resident set size (RSS) in processes that call ImageMagick PNG writers without a corresponding increase in workload
Repeated MemoryAllocationFailed writer exceptions logged by ImageMagick or embedding applications
Out-of-memory kills (oom-killer) targeting image processing workers or web application processes

Detection Strategies

Inventory hosts running ImageMagick and compare installed versions against 6.9.13-57 and 7.1.2-32
Correlate inbound PNG upload or conversion requests with memory growth in handler processes to identify abusive clients
Alert on repeated writer exception strings in application logs that reference PNG encoding failures

Monitoring Recommendations

Track per-process memory and heap allocations for services that invoke ImageMagick, with alerts on sustained upward trends
Monitor rate and source IP distribution of PNG encode requests to identify volumetric abuse
Forward application and system logs to a centralized analytics platform for correlation across hosts

How to Mitigate CVE-2026-109260

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-57 or 7.1.2-32 or later on all affected systems
Audit container images, build pipelines, and third-party applications that bundle ImageMagick and rebuild with patched versions
Apply rate limiting and request-size limits to any public endpoint that triggers PNG encoding

Patch Information

The upstream fix is published in the GitHub Security Advisory GHSA-hvwf-wmm6-hvc3. The code changes are available in commit fd1b9c85 for ImageMagick 7.x and commit 55346382 for ImageMagick 6.x. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict PNG encoding operations through ImageMagick policy.xml resource limits for memory, map, and width/height to constrain per-request allocations
Enforce authentication and request quotas on APIs that expose image conversion to untrusted clients
Deploy process-level memory limits (for example systemdMemoryMax or container --memory flags) to contain the blast radius of leaked allocations

bash

# Example ImageMagick policy.xml hardening to constrain PNG encoder resource usage
# File: /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="map" value="512MiB"/>
  <policy domain="resource" name="width" value="8KP"/>
  <policy domain="resource" name="height" value="8KP"/>
  <policy domain="resource" name="disk" value="1GiB"/>
</policymap>