CVE-2026-107208: ImageMagick: Denial of service with crafted XMP profile

Q: Who is exposed to this issue?

Systems that process images with affected ImageMagick versions are exposed when they handle an image containing a crafted XMP profile. The provided vector indicates the attack can be performed remotely without authentication or user interaction.

Q: What does successful exploitation do?

A crafted XMP profile can cause ImageMagick to treat a recursion-limit condition as fatal, terminating the image-processing process. The stated impact is denial of service; no confidentiality or integrity impact is indicated.

Q: Which versions contain the fix?

The issue is fixed in ImageMagick 7.1.2-30 and 6.9.13-55. Versions prior to those releases are affected.

Published Oct 7, 2026

Updated

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

Affected Software

7 affected componentsFixes available

ImageMagick ImageMagick<7.1.2-30, <6.9.13-55

ImageMagick ImageMagick<6.9.13-55

ImageMagick ImageMagick>=7.0.0-0<7.1.2-30

debian/imagemagick<8:6.9.11.60+dfsg-1.6+deb12u14

8:6.9.11.60+dfsg-1.6+deb12u14

debian/imagemagick<8:7.1.1.43+dfsg1-1+deb13u13

8:7.1.1.43+dfsg1-1+deb13u13

debian/imagemagick<8:7.1.2.31+dfsg1-1

8:7.1.2.31+dfsg1-1

debian/imagemagick<=8:6.9.11.60+dfsg-1.6+deb12u11, <=8:7.1.1.43+dfsg1-1+deb13u12

8:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u148:7.1.2.34+dfsg1-18:7.1.2.35+dfsg1-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u14
Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.1.43+dfsg1-1+deb13u13
Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.31+dfsg1-1
Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-30
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-55

Event History

Oct 7, 2026

CVE Published

via MITRE·03:56 PM

Data Sourced

via MITRE·03:56 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6593

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4858-1

Frequently Asked Questions

Who is exposed to this issue?

Systems that process images with affected ImageMagick versions are exposed when they handle an image containing a crafted XMP profile. The provided vector indicates the attack can be performed remotely without authentication or user interaction.

What does successful exploitation do?

A crafted XMP profile can cause ImageMagick to treat a recursion-limit condition as fatal, terminating the image-processing process. The stated impact is denial of service; no confidentiality or integrity impact is indicated.

Which versions contain the fix?

The issue is fixed in ImageMagick 7.1.2-30 and 6.9.13-55. Versions prior to those releases are affected.

CVE-2026-107208: ImageMagick: Denial of service with crafted XMP profile

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does successful exploitation do?

Which versions contain the fix?

Company

Resources

Contact