CVE-2026-109272: ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder
ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.1.43+dfsg1-1+deb13u14 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions from 7.1.1-31 up to, but not including, 7.1.2-32 are affected when they process PostScript files. The vulnerable code is in the PostScript decoder.
What must an attacker do to trigger the crash?
An attacker must be able to provide a crafted PostScript file to an application for ImageMagick to process. The crash is triggered when a policy limit is reached during PostScript decoding.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied CVSS vector. However, exploitation depends on the attacker being able to submit a crafted PostScript file for processing.
What is the impact of successful exploitation?
Successful exploitation crashes the application processing the file, resulting in a denial of service. The provided data indicates no confidentiality or integrity impact.