CVE-2026-109261: ImageMagick GIF Encoder DOS Vulnerability

CVE-2026-109261 Overview

CVE-2026-109261 is a memory leak vulnerability in ImageMagick's GIF encoder affecting versions before 6.9.13-57 and 7.x before 7.1.2-32. The flaw resides in coders/gif.c, where allocated memory buffers are not released when color quantization fails during GIF encoding. Attackers can submit crafted images that trigger quantization failures, causing memory to leak with each conversion attempt. Repeated exploitation degrades availability of the hosting service. The weakness is classified under [CWE-401: Missing Release of Memory after Effective Lifetime].

Critical Impact
Remote attackers can exhaust server memory by repeatedly submitting malformed images to any service that converts images to GIF using vulnerable ImageMagick builds.

Affected Products

ImageMagick versions prior to 6.9.13-57
ImageMagick 7.x versions prior to 7.1.2-32
Applications and web services embedding vulnerable ImageMagick for GIF conversion

Discovery Timeline

2026-10-12 - CVE-2026-109261 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109261

Vulnerability Analysis

The vulnerability occurs inside the GIF writer in coders/gif.c. When ImageMagick encodes an image to GIF, it allocates global_colormap, colormap, and a write_info structure. If the source image is DirectClass or contains more than 256 colors, the encoder invokes color quantization. When quantization fails, the code path immediately calls ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed") without releasing the previously allocated buffers. Each failed encoding leaks memory, and sustained requests drive the process toward resource exhaustion. Because ImageMagick is widely embedded in upload pipelines, a single network-reachable endpoint can be used to degrade an entire service.

Root Cause

The root cause is missing cleanup logic on an error branch. The exception macro aborts the writer without freeing global_colormap, colormap, or write_info, violating the allocator-releaser pairing contract required by the ImageMagick memory API.

Attack Vector

An unauthenticated remote attacker uploads or references an image that forces GIF encoding with more than 256 colors or DirectClass storage. Each conversion attempt leaks the quantization buffers. Repeated requests accumulate leaked memory until the host process is killed or the system becomes unresponsive.

// Patched code in coders/gif.c — Source: https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221
            }
        }
      if ((image->storage_class == DirectClass) || (image->colors > 256))
-       ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+       {
+         global_colormap=(unsigned char *) RelinquishMagickMemory(
+           global_colormap);
+         colormap=(unsigned char *) RelinquishMagickMemory(colormap);
+         write_info=DestroyImageInfo(write_info);
+         ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+       }
      for (bits_per_pixel=1; bits_per_pixel < 8; bits_per_pixel++)
        if ((one << bits_per_pixel) >= image->colors)
          break;

The patch adds explicit calls to RelinquishMagickMemory and DestroyImageInfo before raising the exception, ensuring allocations are freed on the failure path. The identical fix was applied to the ImageMagick 6 branch in commit 93aa075f.

Detection Methods for CVE-2026-109261

Indicators of Compromise

Progressive memory growth in processes running convert, magick, or linked libMagickCore
Repeated ResourceLimitError: MemoryAllocationFailed entries in ImageMagick logs
OOM killer events targeting image-processing worker processes
Spikes in uploads of high-color-depth images routed to GIF conversion endpoints

Detection Strategies

Monitor resident set size (RSS) of ImageMagick worker processes over time and alert on sustained growth without release.
Inspect ImageMagick delegate logs for recurring MemoryAllocationFailed exceptions tied to GIF output.
Correlate HTTP upload volume with memory consumption on image-processing hosts to identify abusive clients.

Monitoring Recommendations

Enable ImageMagick resource policies via policy.xml and log policy violations.
Instrument conversion pipelines with per-request memory accounting and request IDs.
Alert on process restarts caused by cgroup memory limits in container runtimes.

How to Mitigate CVE-2026-109261

Immediate Actions Required

Upgrade ImageMagick to 6.9.13-57 or 7.1.2-32 or later across all hosts.
Inventory applications that bundle ImageMagick libraries and patch embedded copies.
Enforce input validation on uploaded images, rejecting excessive color depth or dimensions before conversion.
Run image conversion workers under strict memory cgroups to contain leaks until patched.

Patch Information

The maintainers released fixes in ImageMagick 6.9.13-57 and 7.1.2-32. The upstream patches are available in commit 1c776326 and commit 93aa075f. Additional context is published in the GHSA-w68r-6fmr-cvg4 advisory and the VulnCheck advisory.

Workarounds

Disable the GIF coder in policy.xml if GIF output is not required.
Apply memory and map resource limits in ImageMagick policy to bound per-request allocations.
Restrict GIF conversion to authenticated users and rate-limit upload endpoints.
Recycle image-processing worker processes after a bounded number of requests to reclaim leaked memory.

bash

# Example /etc/ImageMagick-7/policy.xml hardening
<policymap>
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="map" value="512MiB"/>
  <policy domain="resource" name="width" value="8KP"/>
  <policy domain="resource" name="height" value="8KP"/>
  <policy domain="coder" rights="none" pattern="GIF"/>
</policymap>