CVE-2026-109266: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.2.34+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to supply a crafted input file that is converted to Cisco IP Phone XML using the CIP encoder. The vulnerable encoder fails to escape input-derived data, allowing arbitrary markup to be inserted into the generated XML.
Are deployments affected by default?
The issue is relevant where ImageMagick is used to convert attacker-controlled or otherwise untrusted files to CIP format. The provided data does not establish whether CIP conversion is enabled or used by default.
What versions should be remediated?
Upgrade ImageMagick 6 to 6.9.13-57 or later, or ImageMagick 7 to 7.1.2-32 or later. Versions before those releases are affected.
What can be done if an upgrade cannot happen immediately?
Avoid converting untrusted input files to CIP format, or prevent use of the CIP encoder for such conversion workflows. This removes the conversion path required to inject markup into generated Cisco IP Phone XML.