CVE-2026-109266
Received Received - Intake

ImageMagick CIP Encoder XML Injection Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109266
EUVD
EUVD-2026-97710

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an XML injection flaw in ImageMagick's CIP (Cisco IP Phone) encoder. It occurs because the software fails to properly escape input-derived data when generating Cisco IP Phone XML output. Attackers can exploit this by providing a specially crafted file that, when converted to CIP format, injects arbitrary markup into the resulting XML.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick on your system. Run: convert --version or identify -version. If the version is below 6.9.13-57 or 7.1.2-32, the system is vulnerable. Additionally, monitor for unexpected XML output or injection attempts in logs when processing CIP files.

Impact Analysis

This vulnerability could allow attackers to inject malicious XML markup into output files. This might lead to code execution, data corruption, or other unintended behavior in systems processing the generated XML. It primarily affects users who convert images to CIP format using vulnerable versions of ImageMagick.

Mitigation Strategies

Immediately update ImageMagick to version 6.9.13-57 or later, or 7.1.2-32 or later. If updating is not possible, disable the CIP encoder by removing or renaming the cip.so module in ImageMagick's modules directory. Avoid processing untrusted CIP files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109266. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart