CVE-2026-109259 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder
Attackers can disclose uninitialized memory contents by supplying a crafted TGA image to ImageMagick, potentially leaking sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109259?
CVE-2026-109259 is a medium-severity vulnerability in ImageMagick, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.
Weakness: CWE-200
Which versions are affected by CVE-2026-109259?
How do I fix CVE-2026-109259?
Upgrade to a fixed version.
Is CVE-2026-109259 being exploited?
There is no known exploitation of CVE-2026-109259 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1792611726, DEBIAN-CVE-2026-109259, ECHO-8b47-eb1c-6ddf, GHSA-965v-2p9m-53v8, GHSA-h499-883p-vph8, UBUNTU-CVE-2026-109259.