CVE-2026-109269
Received Received - Intake

Information Disclosure in ImageMagick JPEG Decoder

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109269
EUVD
EUVD-2026-97713

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in ImageMagick's JPEG decoder. When processing specially crafted JPEG files, the software performs a read operation that exposes uninitialized memory contents. This happens because the decoder does not properly handle memory bounds, allowing attackers to access sensitive data that should remain hidden.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: convert --version or identify --version. If the version is below 6.9.13-57 for ImageMagick 6 or below 7.1.2-32 for ImageMagick 7, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to read uninitialized memory from your system when you process a malicious JPEG file. This might expose sensitive information such as passwords, encryption keys, or other confidential data stored in memory. The impact depends on what data is present in memory at the time of exploitation.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations processing such data must ensure systems are patched to prevent potential breaches that could result in regulatory penalties or legal consequences.

Mitigation Strategies

Immediately update ImageMagick to version 6.9.13-57 or later for ImageMagick 6, or version 7.1.2-32 or later for ImageMagick 7. Apply patches from the official ImageMagick repository or trusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart