CVE-2026-109268: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.2.34+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions earlier than 6.9.13-57 or 7.x versions earlier than 7.1.2-32 are affected when they write CMYK images to PDF using JPEG2000 compression.
What must an attacker be able to do to trigger the flaw?
An attacker needs to supply a crafted CMYK image that the affected ImageMagick deployment processes and writes as a PDF with JPEG2000 compression. No authentication or user interaction is required according to the provided vector.
What is the expected impact if exploitation succeeds?
The use-after-free condition can cause freed memory to be reused and may crash the ImageMagick process. The provided impact vector indicates availability impact only, with no stated confidentiality or integrity impact.
What can be done before upgrading?
Avoid converting untrusted CMYK images to PDF with JPEG2000 compression until ImageMagick can be updated. Restricting or disabling that conversion path reduces exposure based on the affected condition described.