CVE-2026-109268
Imagemagick: use-after-free can lead to denial of service
- Risk score
- 56/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the pr…
- Affected
- Imagemagick before 6.9.13, 7.1.2
- Fix
- Upgrade Imagemagick to 6.9.13 or 7.1.2 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Story map
At a glance
Imagemagick: Yellow, plan it in. ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7…
The flaws
- CVE-2026-109268: Use-after-free can lead to denial of service (CVSS 7.5 · EPSS 0%)
- CVE-2026-106580: Access control flaw can lead to denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-106573: Denial of service (CVSS 7.5 · EPSS 0%)
- CVE-2026-106576: Denial of service (CVSS 7.5 · EPSS 0%)
The fix
Upgrade Imagemagick: 6.9.13 · 7.1.2 or later on your release line
Who is exposed: Imagemagick before 7.1.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Use-after-free (CWE-416). 400 other warnings in 30 days
- Same product: Earlier Imagemagick warnings. 69 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
- https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv
- https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5
- https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000
Original description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process.
Last activity 12 Oct 2026. Patch Forecast updates every hour.