VYPR
Published Oct 12, 2026· Updated Oct 13, 2026· 1 source

ImageMagick: 25 Vulnerabilities Disclosed, Affecting Multiple Image Formats and Operations

Key findings • 25 ImageMagick vulnerabilities disclosed on October 12, 2026, affecting versions prior to 6.9.13-57 and 7.1.2-32. • Issues include memory leaks, use-after-free, buffer over-rea…

Key findings

  • 25 ImageMagick vulnerabilities disclosed on October 12, 2026, affecting versions prior to 6.9.13-57 and 7.1.2-32.
  • Issues include memory leaks, use-after-free, buffer over-reads, and type confusion across multiple image formats and operations.
  • Vulnerabilities can lead to denial-of-service, information disclosure, and potential code/XML injection.
  • Patched versions are 6.9.13-57 and 7.1.2-32; users are urged to update promptly.
  • The batch includes DoS via memory exhaustion in encoders and stack overflows in decoders.

On October 12, 2026, a significant batch of 25 vulnerabilities was disclosed for ImageMagick, affecting both its 6.x and 7.x branches. These vulnerabilities, primarily discovered and reported together, span a range of issues including memory corruption, information disclosure, and denial-of-service conditions. The disclosures highlight potential weaknesses in how ImageMagick handles various image formats and internal operations, underscoring the need for prompt patching by users.

Several vulnerabilities stem from improper memory management during image encoding and decoding processes. CVE-2026-109278, CVE-2026-109270, CVE-2026-109263, and CVE-2026-109261 detail memory leaks in operations like wavelet-denoise, the -process option, YUV encoding, and GIF encoding, respectively. These leaks can be triggered by specially crafted inputs, leading to gradual memory exhaustion and potential denial of service. Similarly, CVE-2026-109271 and CVE-2026-109268 describe use-after-free vulnerabilities in the WBINFO and PDF writers, respectively, which can be exploited by crafted images to crash the application or corrupt memory.

Other vulnerabilities focus on information disclosure and type confusion. CVE-2026-109281 and CVE-2026-109269 involve heap buffer over-reads in the -fx option and JPEG decoder, respectively, potentially exposing sensitive memory contents. CVE-2026-109273 and CVE-2026-109259 detail uninitialized memory reads in the PostScript and TGA decoders, respectively, which can also lead to information disclosure. CVE-2026-109282 points to a type confusion flaw in INFO, JSON, and YAML encoders, which can result in crashes.

Denial-of-service vulnerabilities are also prevalent. CVE-2026-109276 describes an incomplete cleanup flaw in the JNG decoder that can lead to disk space exhaustion through temporary file leaks. CVE-2026-109267 and CVE-2026-109264 highlight stack overflows in the MSL and MVG decoders due to uncontrolled recursion, respectively, leading to process crashes. CVE-2026-109277, a policy bypass vulnerability in the -script operation, allows attackers to circumvent security policies by manipulating file descriptors.

Security policy and code injection vulnerabilities were also disclosed. CVE-2026-109274 describes a time-of-check time-of-use symlink race vulnerability that can bypass the path security policy during script execution. CVE-2026-109275 points to a code injection vulnerability in the MVG decoder when a PostScript renderer is used, allowing attackers to inject code into the rendering path. CVE-2026-109266 details an XML injection vulnerability in the CIP encoder, enabling arbitrary markup injection into Cisco IP Phone XML output.

The majority of these vulnerabilities are addressed in ImageMagick versions 6.9.13-57 and 7.1.2-32. Users are strongly advised to update to these patched versions to mitigate the risks associated with this extensive batch of disclosures. The wide range of issues underscores the importance of keeping ImageMagick updated, especially for systems that process untrusted image files.

The patched versions are 6.9.13-57 for the 6.x branch and 7.1.2-32 for the 7.x branch. Users should verify their installed versions and upgrade accordingly. The consistent disclosure of multiple vulnerabilities in a single batch suggests a coordinated effort in identifying and reporting these security flaws, emphasizing the ongoing need for vigilance in software maintenance.

Key vulnerabilities include:

  • Memory leaks in various encoders (YUV, GIF, PNG, SVG) and operations (-fx, -process) leading to DoS.
  • Use-after-free vulnerabilities in WBINFO and PDF writers, exploitable with crafted images.
  • Information disclosure via heap buffer over-reads and uninitialized memory reads in multiple decoders and formats.
  • Stack overflows and crashes due to uncontrolled recursion in MSL and MVG decoders.
  • Code and XML injection vulnerabilities in MVG and CIP encoders.

The consistent patching across both major branches (6.x and 7.x) in the provided version numbers indicates a comprehensive fix for this disclosure event. Users should prioritize updating to the latest versions to protect against these diverse security risks.

CVE-2026-109282, CVE-2026-109281, CVE-2026-109280, CVE-2026-109279, CVE-2026-109278, CVE-2026-109277, CVE-2026-109276, CVE-2026-109275, CVE-2026-109274, CVE-2026-109273, CVE-2026-109272, CVE-2026-109271, CVE-2026-109270, CVE-2026-109269, CVE-2026-109268, CVE-2026-109267, CVE-2026-109266, CVE-2026-109265, CVE-2026-109264, CVE-2026-109263, CVE-2026-109262, CVE-2026-109261, CVE-2026-109260, CVE-2026-109259, CVE-2026-109258

Synthesized by Vypr AI