CVE-2026-109265

5.3Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-125

Impact

Remote attackers can crash services processing user-supplied images, causing a denial of service. Exploitation requires sending a specially crafted image file with a malformed XMP profile to the target application.

Root cause

Improper null-termination handling when parsing XMP profile strings leads to a heap buffer over-read.

Affected systems

ImageMagick 7.1.1-7 through versions prior to 7.1.2-32

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade ImageMagick to version 7.1.2-32 or newer. If you cannot patch immediately, block or sanitize untrusted image uploads or strip XMP profile metadata before ingestion.

shell

$ magick -version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109265