ImageMagick before 7.1.2‑26 (and 6.x before 6.9.13‑51) has a memory‑leak flaw in its TIFF encoder. When the encoder attempts to create a temporary file and fails, it does not release the memory allocated for that operation, causing a persistently small leak. If an attacker or a benign workload repeatedly processes TIFF images, the unused memory accumulates and can eventually lead to resource exhaustion or service disruption. The likely attack vector is inferred from the requirement to supply TIFF input that triggers the encoder’s failure path.

The vulnerability affects all ImageMagick releases prior to 7.1.2‑26 on the main branch and prior to 6.9.13‑51 on the 6.x branch. Administrators should verify the installed version against these boundaries and plan an upgrade or mitigation strategy.

The CVSS score of 2.1 denotes low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply TIFF files to invoke the encoder, so the risk is higher in systems that accept untrusted image uploads or invoke the encoder on remote input. The likely attack vector is inferred from the description that the encoder’s crash path is triggered by TIFF input, implying that repeated processing of such files is required. The leak grows over time, meaning large numbers of processed files may be required before a noticeable impact manifests.