Information Disclosure Vulnerability in ImageMagick by ImageMagick Studio LLC
CVE-2026-109273

6.9MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109273?

A vulnerability has been identified in ImageMagick, where an improper allocation in the PostScript decoder can expose sensitive information. Specifically, this issue arises due to the allocation of a buffer that is one byte longer than the decoded data, allowing attackers to utilize crafted PostScript files to potentially reveal uninitialized memory contents. This exposure can lead to the unintended disclosure of information, emphasizing the need for users to update their versions to mitigate this risk.

Affected Version(s)

ImageMagick 7.0.0-0 < 7.1.2-32

ImageMagick 0 < 6.9.13-57

ImageMagick 7.1.2-32

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://github.com/ImageMagick/ImageMagick/commit/5a5c2e5...
patch
https://github.com/ImageMagick/ImageMagick6/commit/a32215...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yanhaoxi
.