ImageMagick contains a memory leak in its PNG encoder that is triggered when the libpng initialization routine fails. The failed initialization path does not release any memory that was allocated, allowing the process to steadily consume more RAM until it exhausts the system’s memory quota and stops functioning. This flaw is a classic example of CWE‑401: Memory Management Issues, and it could be used by an attacker to force a denial of service on the system or application which uses ImageMagick for PNG processing. It also involves a resource exhaustion scenario categorized as CWE‑772.

The vulnerability affects all ImageMagick releases in the 6.x line up to and including 6.9.13‑56, and all releases in the 7.x line up to and including 7.1.2‑31. Users of the 6.x series should upgrade to 6.9.13‑57 or newer, and users of the 7.x series should upgrade to 7.1.2‑32 or newer.

With a CVSS score of 6.3, the issue is classified as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been documented. The likely attack surface involves an application that accepts PNG data from untrusted sources; repeating malformed PNG encoding operations can trigger the memory leak. While no public exploit is known, the nature of the flaw means that an attacker who can feed many failing PNG inputs to a running service can exhaust memory, terminate the service, and cause a denial of service.