CVE-2026-109282
Received Received - Intake

Type Confusion in ImageMagick Leads to DoS

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109282
EUVD
EUVD-2026-97584

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a type confusion flaw in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32. It occurs in the INFO, JSON, and YAML encoders when writing an image in a compressed format. The flaw causes an internal method to receive an unexpected pointer type, leading to crashes like SIGABRT or SIGSEGV.

Detection Guidance

To detect this vulnerability, check the installed ImageMagick version using 'convert --version' or 'magick --version'. If the version is below 6.9.13-57 (for ImageMagick 6) or 7.1.2-32 (for ImageMagick 7), the system is vulnerable. Additionally, monitor for crashes or SIGABRT/SIGSEGV errors when processing images with INFO, JSON, or YAML encoders in compressed formats.

Impact Analysis

This vulnerability can cause denial of service by crashing the ImageMagick process. An attacker who can provide a specially crafted image file may trigger the crash, disrupting services that rely on ImageMagick for image processing.

Compliance Impact

This vulnerability causes process crashes (SIGABRT/SIGSEGV) during image processing, leading to denial of service. While it does not directly impact data confidentiality or integrity, availability disruptions could affect systems handling sensitive data. However, no evidence suggests direct non-compliance with GDPR or HIPAA due to this issue alone.

Mitigation Strategies

Upgrade ImageMagick to version 6.9.13-57 or later for version 6.x, or to version 7.1.2-32 or later for version 7.x to address the type confusion flaw in INFO, JSON, and YAML encoders.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109282. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart