CVE-2026-109273
Received Received - Intake

Information Disclosure in ImageMagick PostScript Decoder

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109273
EUVD
EUVD-2026-97717

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-908 The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in ImageMagick's PostScript decoder. It occurs because the decoder allocates a buffer one byte longer than the data it decodes, leaving an uninitialized memory byte exposed. Attackers can craft a PostScript file to read this single byte of memory contents.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick. Run: convert --version or identify -version. If the version is below 6.9.13-57 or 7.1.2-32, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to read a small amount of sensitive or confidential memory data from systems processing malicious PostScript files. This may include fragments of other files, passwords, or other sensitive information.

Mitigation Strategies

Upgrade ImageMagick to version 6.9.13-57 or later for ImageMagick 6, or 7.1.2-32 or later for ImageMagick 7. Apply patches from the official ImageMagick repository or your distribution's update mechanism.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart