CVE-2026-109282 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders
An attacker can cause a denial of service by triggering a crash in ImageMagick's INFO, JSON, and YAML encoders via type confusion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109282?
CVE-2026-109282 is a low-severity memory corruption vulnerability in ImageMagick, published on 12 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service.
Weakness: CWE-843
Which versions are affected by CVE-2026-109282?
How do I fix CVE-2026-109282?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-109282 being exploited?
There is no known exploitation of CVE-2026-109282 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-109282, ECHO-9a12-4568-811c, GHSA-7vwq-g262-xfgj, GHSA-8xmr-6q99-c4x8, UBUNTU-CVE-2026-109282.