CVE-2026-109276
Received Received - Intake

Incomplete Cleanup Flaw in ImageMagick Leads to Disk Space Exhaustion

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109276
EUVD
EUVD-2026-97720

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ImageMagick involves a flaw in the JNG decoder where temporary files are not properly cleaned up after processing crafted JNG files. Attackers can exploit this to repeatedly leak temporary files, consuming disk space and degrading system availability.

Detection Guidance

To detect this vulnerability, monitor for unusual disk space consumption or temporary file accumulation in ImageMagick processing directories. Check for unclosed file handles in JNG processing tasks. Use system monitoring tools like 'df -h' to track disk usage and 'lsof' to list open files during ImageMagick operations.

Impact Analysis

The vulnerability can lead to disk space exhaustion and reduced system performance due to repeated temporary file leaks. It does not directly compromise confidentiality or integrity but may cause availability issues.

Mitigation Strategies

Immediately upgrade ImageMagick to versions 6.9.13-57 or later and 7.1.2-32 or later. Remove or restrict access to JNG file processing if possible. Monitor disk space and temporary file directories for abnormal growth. Apply patches from the official ImageMagick repository.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart