CVE-2026-106576: ImageMagick: Denial of service possible when parsing an XMP profile.

Q: Who is exposed to this denial-of-service issue?

Any deployment using ImageMagick before 7.1.2-31 may be exposed if it parses XMP profiles from crafted images. Exploitation can be performed remotely without authentication or user interaction.

Q: What does an attacker need to exploit it?

An attacker needs to supply a crafted XMP profile that causes excessive work while ImageMagick determines a rational value's numerator and denominator. The reported impact is denial of service; no confidentiality or integrity impact is listed.

Q: How can the issue be remediated?

Upgrade ImageMagick to version 7.1.2-31, which fixes the issue.

Published Oct 7, 2026

Updated

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31.

Affected Software

1 affected component

ImageMagick ImageMagick<7.1.2-31

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-31

Event History

Oct 7, 2026

CVE Published

via MITRE·03:37 PM

Data Sourced

via MITRE·03:37 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Any deployment using ImageMagick before 7.1.2-31 may be exposed if it parses XMP profiles from crafted images. Exploitation can be performed remotely without authentication or user interaction.

What does an attacker need to exploit it?