Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-109270

Fixed in a distro release EPSS <1%CVSS 3.3

ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to gradually exhaust memory and degrade service availability.

Published 2026-10-12 · CVE record · OSV

Products: imagemagick

Distro releases

ReleasePackageFixed in
Debian 12imagemagickno fix
Debian 13imagemagickno fix
Debian 14imagemagickno fix
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7ImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server 15 SP4-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server 15 SP5-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server 15 SP6-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4ImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5ImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6ImageMagick7.1.0.9-150400.6.122.1
Ubuntu 26.10imagemagickno fix
Ubuntu Pro 14.04 LTSimagemagickno fix
Ubuntu Pro 16.04 LTSimagemagickno fix
Ubuntu Pro 18.04 LTSimagemagickno fix
Ubuntu Pro 20.04 LTSimagemagickno fix
Ubuntu Pro 22.04 LTSimagemagickno fix
Ubuntu Pro 24.04 LTSimagemagickno fix
Ubuntu Pro 26.04 LTSimagemagickno fix
openSUSE TumbleweedImageMagick7.1.2.34-1.1