Description

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-07T13:20:40.827Z",
  "pubdate": "2026-09-07T13:20:40.827Z",
  "executiveSummary": "This vulnerability involves a memory resource management failure within the ImageMagick OpenPixelCache component. The flaw arises from an improper handling of the memory budget during failed operations, leading to a state where the process fails to reconcile its resource allocation after a transaction error.\nThe vulnerability affects ImageMagick versions prior to 7.1.2-30 and 6.9.13-55. The primary security impact is a Denial of Service (DoS), characterized by the systematic exhaustion of the process memory budget.\nAn unauthenticated, remote attacker can trigger this vulnerability by repeatedly submitting specially crafted requests that force specific operations within the OpenPixelCache to fail. By inducing these failures, the attacker forces the application to leak or improperly manage memory quotas, eventually preventing legitimate users from accessing the service. This vulnerability does not require administrative privileges, making it a significant concern for environments where ImageMagick is exposed to untrusted input, such as web-based image processing services or content management systems.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic governing memory budget management within the OpenPixelCache function. When an operation is initiated within the cache subsystem, ImageMagick allocates a portion of the defined memory budget to facilitate the transaction. However, the system fails to correctly decrement or reset the reserved memory budget if the underlying operation encounters an error or returns an exception. This logic gap results in a persistent memory accounting error where the available memory pool is prematurely depleted despite the failed operations failing to produce any useful artifacts.\nThe attack flow proceeds as follows: An attacker submits a series of malformed image files or requests designed to trigger an error state within the OpenPixelCache module. Upon each failure, the internal counter representing the 'current memory usage' fails to return to the baseline state. Because the application logic does not properly free or reconcile the accounting of these 'ghost' allocations, the cumulative effect of these failures eventually exhausts the total memory budget designated for the process. Once the exhaustion threshold is reached, subsequent attempts to allocate memory for valid image processing tasks fail, resulting in a denial of service.\nThe vulnerability is localized to the OpenPixelCache, which is responsible for managing pixel data storage and cache operations. Since the policy manager responsible for enforcing the memory budget is bypassed or incorrectly updated during error handling, the process continues to believe it has less available memory than it actually does. This is a state-dependent exhaustion, where the impact is magnified by the number of requests sent by the attacker.\nExploitation does not require high-level privileges; the adversary only needs the capability to submit data to the ImageMagick parser. Given that many web applications interface directly with ImageMagick to process user-uploaded images, this vulnerability can be exploited over a network without authentication. Post-exploitation, the service becomes unresponsive to further processing requests, forcing a restart of the service to reclaim the erroneously 'occupied' memory. The lack of proper cleanup during exception handling represents a significant failure in robust resource lifecycle management."
}