XML Injection Vulnerability in ImageMagick Product by ImageMagick
CVE-2026-109266
6.9MEDIUM
What is CVE-2026-109266?
ImageMagick versions prior to 6.9.13-57 and 7.x before 7.1.2-32 are susceptible to an XML injection flaw within the CIP encoder. This issue arises due to improper escaping of input-derived data, allowing attackers to craft malicious files that, when converted to CIP format, can inject arbitrary markup into the resulting XML. Such vulnerabilities can lead to exploit scenarios affecting the application’s integrity and the security of the system leveraging this software.
Affected Version(s)
ImageMagick 7.0.0-0 < 7.1.2-32
ImageMagick 0 < 6.9.13-57
ImageMagick 7.1.2-32