CVE-2026-109265 ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile
Attackers can cause a crash or read sensitive memory by supplying a crafted image with a malformed XMP profile to ImageMagick.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109265?
CVE-2026-109265 is a medium-severity memory corruption vulnerability in ImageMagick, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.
Weakness: CWE-125
Which versions are affected by CVE-2026-109265?
How do I fix CVE-2026-109265?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-109265 being exploited?
There is no known exploitation of CVE-2026-109265 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-109265, ECHO-3711-a0ad-7dae, GHSA-jph3-37cg-79wg, GHSA-qh9r-xv2x-fw97, UBUNTU-CVE-2026-109265.