CVE-2026-109273: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.2.34+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1
Event History
Frequently Asked Questions
Which ImageMagick releases are affected?
Affected releases are ImageMagick versions before 6.9.13-57 and 7.x versions before 7.1.2-32.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted PostScript file that is processed by ImageMagick's PostScript decoder. The listed vector indicates network reachability, low attack complexity, and no required privileges or user interaction.
What information can be exposed?
The flaw can expose one uninitialized byte of memory contents per successful crafted input. The provided information does not indicate that integrity or availability are affected.
How can I determine whether an installation is affected?
Check the installed ImageMagick version and whether it processes PostScript files. Installations running a version earlier than 6.9.13-57, or a 7.x version earlier than 7.1.2-32, are affected.