CVE-2026-109270: ImageMagick Memory Leak DoS Vulnerability

CVE-2026-109270 Overview

CVE-2026-109270 is a memory leak vulnerability [CWE-401] affecting ImageMagick versions prior to 7.1.2-32. The flaw resides in the handling of the -process command-line option within MagickWand/operation.c. When an attacker supplies crafted arguments to -process, the application fails to release allocated memory. Repeated invocations gradually exhaust available memory and degrade service availability on affected hosts.

The issue requires local access with low privileges and no user interaction. Exploitation does not impact confidentiality or integrity but affects availability of the ImageMagick process and any service that invokes it.

Critical Impact
Repeated invocation of the -process option with specific arguments causes unreleased memory allocations, enabling local attackers to exhaust system memory and disrupt availability.

Affected Products

ImageMagick versions prior to 7.1.2-32
Applications and services that embed ImageMagick for image processing
Linux and Unix systems packaging vulnerable ImageMagick builds

Discovery Timeline

2026-10-12 - CVE-2026-109270 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109270

Vulnerability Analysis

The vulnerability is a memory leak in the ImageMagick CLI argument processor. When the -process option is parsed in MagickWand/operation.c, the function calls StringToArgv() to tokenize the supplied argument string. If the resulting argument array is NULL or contains only a single element, the original code executed break without freeing the allocated arguments buffer or its member strings.

Each failed parse leaked both the outer char **arguments allocation and any strings previously assigned to it. In long-running processes or services that invoke ImageMagick repeatedly, the leaked allocations accumulate until memory is exhausted. The flaw cannot be exploited for code execution or data disclosure, but it reliably degrades availability.

Root Cause

The root cause is missing cleanup on an early-exit branch. The original code path did not call RelinquishMagickMemory() on the arguments pointer or DestroyString() on member elements before break. The patch introduces a DestroyArguments macro that iterates through all allocated strings and releases the backing memory before exiting the branch.

Attack Vector

An attacker with local, low-privileged access invokes magick or convert with repeated -process operations containing arguments that trigger the early-return path. Services exposing ImageMagick to untrusted input (web upload handlers, batch converters) may be remotely reachable through those applications, amplifying the practical attack surface beyond pure local access.

// Patch excerpt from MagickWand/operation.c
       if (LocaleCompare("process",option+1) == 0)
         {
+#define DestroyArguments(arguments,argc) \
+          do \
+          { \
+            ssize_t j = 0; \
+            for ( ; j < (ssize_t) (number_arguments); j++) \
+              (arguments)[j]=DestroyString((arguments)[j]); \
+            (arguments)=(char **) RelinquishMagickMemory(arguments); \
+          } while (0)
+
           char
             **arguments;
           int
             number_arguments;

           arguments=StringToArgv(arg1,&number_arguments);
           if ((arguments == (char **) NULL) || (number_arguments == 1))
-            break;
+            {
+              DestroyArguments(arguments,number_arguments);
+              break;
+            }

Source: GitHub Commit da4cfd7

Detection Methods for CVE-2026-109270

Indicators of Compromise

Steady growth in resident set size (RSS) of magick, convert, or long-running processes that embed ImageMagick
Repeated command-line invocations containing -process with malformed or single-token arguments
Out-of-memory (OOM) killer events terminating image-processing workers

Detection Strategies

Inventory installed ImageMagick packages and compare versions against 7.1.2-32 or later
Monitor process memory metrics over time for binaries linking libMagickWand
Audit application logs for frequent -process option usage sourced from untrusted inputs

Monitoring Recommendations

Enable per-process memory accounting (cgroups, systemdMemoryMax) for image-processing workloads
Alert on OOM-kill events from kernel.log or journalctl -k
Track ImageMagick package versions through configuration management to detect drift from patched baselines

How to Mitigate CVE-2026-109270

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-32 or later across all systems
Audit applications that pass user-controlled strings to the -process option and sanitize inputs
Apply resource limits (ulimit -v, cgroup memory caps) to processes invoking ImageMagick

Patch Information

The fix is committed upstream as da4cfd78a2ceea4cf54207834f9d60c1b9c38797 and included in ImageMagick 7.1.2-32. Refer to the GitHub Security Advisory GHSA-f32c-2v6j-wvh5 and the VulnCheck Memory Leak Advisory for additional context.

Workarounds

Disable or restrict use of the -process option in policy.xml where feasible
Run ImageMagick inside short-lived worker processes that recycle after N jobs to bound leaked memory
Enforce strict argument validation on any wrapper that forwards user input to ImageMagick

bash

# Example policy.xml restriction and process recycling
# /etc/ImageMagick-7/policy.xml
# <policy domain="delegate" rights="none" pattern="process" />

# Example systemd hardening for an image worker service
# [Service]
# MemoryMax=512M
# TasksMax=64
# Restart=always
# RuntimeMaxSec=600