CVE-2026-109279: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. An attacker able to induce concurrent security policy access can crash the application, causing a denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using ImageMagick versions before 6.9.13-57 or 7.x before 7.1.2-32 are affected when multiple threads can simultaneously read and write the security policy.
What does an attacker need to do to exploit this issue?
The attacker must be able to induce concurrent access to the ImageMagick security policy, with simultaneous policy reads and writes. The stated impact is an application crash and denial of service.
How can I determine whether my installation is affected?
Check the installed ImageMagick version and whether the application performs concurrent security-policy reads and writes. Versions 6.9.13-57 and later in the 6.x line, and 7.1.2-32 and later in the 7.x line, are not listed as affected.