CVE-2026-109265: ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile
ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions from 7.1.1-7 before 7.1.2-32 are affected when they process images that contain XMP profiles. Systems that accept or transform attacker-supplied image files are the relevant exposure scenario.
What does an attacker need to exploit it?
An attacker needs to provide a crafted image with a malformed XMP profile for the vulnerable ImageMagick instance to process. No authentication or user interaction is required according to the supplied vector.
What is the practical impact?
The malformed XMP profile can cause ImageMagick to read beyond an allocated heap buffer and crash the application. The provided impact information indicates availability impact, with no stated confidentiality or integrity impact.
What version should be deployed to remediate the issue?
Upgrade ImageMagick to version 7.1.2-32 or later. The issue affects versions before 7.1.2-32 within the stated affected range.