CVE-2026-109279

2.5Low

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

2.5Low

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-362

Impact

A local attacker can crash the application, resulting in a denial of service. They need local access and the ability to trigger concurrent security policy lookups in a multithreaded process.

Root cause

Missing thread synchronization when accessing security policy data allows concurrent reads and writes to trigger a heap buffer overflow.

Affected systems

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32

CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade ImageMagick to version 6.9.13-57, 7.1.2-32, or later. No workaround or interim mitigation is documented.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. An attacker able to induce concurrent security policy access can crash the application, causing a denial of service.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109279