CVE-2026-109259: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder

Q: Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 6.9.13-57 or 7.x versions earlier than 7.1.2-32 are affected when they process TGA images.

Q: What does an attacker need to exploit it?

An attacker needs to be able to supply a crafted TGA image to an ImageMagick processing path. The vector is network-accessible and requires no privileges or user interaction.

Q: What information could be exposed?

Processing the crafted image can disclose contents of uninitialized memory from the ImageMagick process. The provided data indicates confidentiality impact only; integrity and availability impact are not indicated.

Q: How can exposure be reduced before upgrading?

Prevent untrusted TGA images from reaching ImageMagick processing paths until the affected version can be upgraded. The issue is specifically in the TGA decoder.

Published Oct 12, 2026

Updated

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-57, <7.1.2-32

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 6.9.13-57 or 7.x versions earlier than 7.1.2-32 are affected when they process TGA images.

What does an attacker need to exploit it?

An attacker needs to be able to supply a crafted TGA image to an ImageMagick processing path. The vector is network-accessible and requires no privileges or user interaction.

What information could be exposed?

Processing the crafted image can disclose contents of uninitialized memory from the ImageMagick process. The provided data indicates confidentiality impact only; integrity and availability impact are not indicated.

How can exposure be reduced before upgrading?

Prevent untrusted TGA images from reaching ImageMagick processing paths until the affected version can be upgraded. The issue is specifically in the TGA decoder.

CVE-2026-109259: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What information could be exposed?

How can exposure be reduced before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What information could be exposed?

How can exposure be reduced before upgrading?