Use After Free Vulnerability in ImageMagick PDF Writer
CVE-2026-109268
6.3MEDIUM
What is CVE-2026-109268?
ImageMagick versions prior to 6.9.13-57 and the 7.x branch before 7.1.2-32 are susceptible to a use after free vulnerability within the PDF writing functionality when handling CMYK images utilizing JPEG2000 compression. By supplying a specially crafted CMYK image, an attacker can manipulate the system into reusing freed memory space, potentially leading to process crashes and unauthorized access. This vulnerability underscores the importance of keeping software up to date to mitigate risks and maintain system integrity.
Affected Version(s)
ImageMagick 7.0.0-0 < 7.1.2-32
ImageMagick 0 < 6.9.13-57
ImageMagick 7.1.2-32