CVE-2026-109269
5.3MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-125
Impact
Remote attackers can read uninitialized memory contents from the host process by submitting a maliciously crafted JPEG file. Exploitation requires no privileges or authentication, only that ImageMagick processes the untrusted image.
Root cause
The JPEG decoder reads and exposes uninitialized memory when processing malformed input.
Affected systems
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade to ImageMagick 6.9.13-57, 7.1.2-32, or later. If patching immediately is not possible, disable the JPEG coder via policy.xml by adding <policy domain="coder" rights="none" pattern="JPEG" />.
$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagickAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory contents.
References
- https://github.com/ImageMagick/ImageMagick/commit/aa104ff2e408bea23828e7a7a346f9080da4104b
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxrx-rjp3-27rj
- https://github.com/ImageMagick/ImageMagick6/commit/acf52477cf05c5ff9c8315d44043589a5190a408
- https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-information-disclosure-via-jpeg-decoder