CVE-2026-109276
MEDIUMCVSS 5.3Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.
Timeline
Published:October 12th, 2026 5:17 PM
Last modified:October 18th, 2026 12:17 PM
CVSS Scoring
CVSS v3: 5.3 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r
- https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b
- https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder
Source: NIST NVD · Data may lag official sources by up to one minute