CVE-2026-109269: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.2.34+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using ImageMagick versions earlier than 6.9.13-57 or 7.x versions earlier than 7.1.2-32 are affected if they process attacker-supplied JPEG files.
What does an attacker need to exploit this issue?
An attacker needs only the ability to supply a crafted JPEG file for ImageMagick to process. No authentication or user interaction is required according to the provided vector.
What is the impact of successful exploitation?
Processing the crafted JPEG can expose uninitialized memory contents. The reported impact is limited to confidentiality; no integrity or availability impact is indicated.
How can I remediate the issue?
Upgrade ImageMagick 6 to version 6.9.13-57 or later, or ImageMagick 7 to version 7.1.2-32 or later.