CVE-2026-109272

3.7Low

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

3.7Low

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-476

Impact

Remote attackers can crash services parsing user-supplied images, causing a denial of service. They only need the ability to submit a crafted PostScript file to an endpoint using ImageMagick.

Root cause

A NULL pointer dereference occurs in the PostScript decoder whenever an internal policy limit is triggered.

Affected systems

ImageMagick 7.1.1-31 before 7.1.2-32

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade ImageMagick to version 7.1.2-32 or later. If you cannot immediately patch, disable PostScript processing by setting policy domain="coder" rights="none" pattern="PS" in policy.xml.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109272