CVE-2026-109282: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions earlier than 6.9.13-57 or ImageMagick 7.x earlier than 7.1.2-32 are affected when they use the INFO, JSON, or YAML encoders to write an image in a compressed format.
What does an attacker need to do to trigger the crash?
The attacker must be able to cause the affected ImageMagick process to write an image in a compressed format through one of the vulnerable encoders. Successful exploitation can terminate the process with SIGABRT or SIGSEGV.
What is the practical impact?
The described impact is denial of service through a process crash. The provided information does not indicate confidentiality disclosure or integrity impact.