CVE-2026-109259: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.1.43+dfsg1-1+deb13u14 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions earlier than 6.9.13-57 or 7.x versions earlier than 7.1.2-32 are affected when they process TGA images.
What does an attacker need to exploit it?
An attacker needs to be able to supply a crafted TGA image to an ImageMagick processing path. The vector is network-accessible and requires no privileges or user interaction.
What information could be exposed?
Processing the crafted image can disclose contents of uninitialized memory from the ImageMagick process. The provided data indicates confidentiality impact only; integrity and availability impact are not indicated.
How can exposure be reduced before upgrading?
Prevent untrusted TGA images from reaching ImageMagick processing paths until the affected version can be upgraded. The issue is specifically in the TGA decoder.