CVE-2026-105402: ImageMagick before 7.1.2-31 Denial of Service via XMP Profile Parsing
Rejected reason: This CVE ID has been rejected as a duplicate.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running ImageMagick versions before 7.1.2-31 are affected if they process images or other inputs that can contain attacker-supplied XMP profiles. The reported impact is disruption of image processing rather than confidentiality or integrity loss.
What does an attacker need to exploit it?
An attacker needs to supply a crafted XMP profile to ImageMagick. The profile triggers a failure while the software determines a numerator and denominator, which can crash or hang processing.
How can I determine whether my environment is affected?
Check the installed ImageMagick version. Versions before 7.1.2-31 are affected; also identify workflows that accept or process untrusted files containing XMP metadata.
What should be done if immediate patching is not possible?
Limit processing of untrusted inputs that may contain XMP profiles until ImageMagick can be updated to 7.1.2-31 or later. Monitor image-processing jobs for crashes or hangs associated with XMP metadata.