CVE-2026-109273
5.3MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-908
Impact
Remote attackers can read a single byte of uninitialized memory by submitting a crafted PostScript file. They need only network access to any service that processes untrusted PostScript via ImageMagick.
Root cause
The PostScript decoder allocates a buffer one byte larger than the decoded data, leaving that trailing byte uninitialized.
Affected systems
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade ImageMagick to version 6.9.13-57, 7.1.2-32, or later. If you cannot patch immediately, disable the PostScript (PS) coder in your policy.xml file.
$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagickAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents.
References
- https://github.com/ImageMagick/ImageMagick/commit/5a5c2e51948fcc5d85b8d832938e2c1b4db4a699
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5j8x-vq8c-vrp9
- https://github.com/ImageMagick/ImageMagick6/commit/a32215ba7a193f2bc896ba6ed4be4013cc06e22b
- https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-information-disclosure-in-postscript-decoder