CVE-2026-102635GHSA-rvv7-5mh8-vcfc
ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder
ImageMagick ImageMagickLibraries & packages
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.
Text from CVE List
Affected versions 2
- ImageMagickaffected: 7.0.0-0 before 7.1.2-32CVE List
- ImageMagickaffected: all versions before 6.9.13-57CVE List
References 6
- github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4Fixvia CVE List
- github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5Fixvia CVE List
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfcAdvisoryvia CVE List
- vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-uninitialized-heap-memory-disclosure-in-gif-decoderAdvisoryvia CVE List
- github.com/ImageMagick/ImageMagick/blob/7.1.2-31/coders/gif.c#L1168-L1196Referencevia CVE List
- github.com/ImageMagick/ImageMagickReferencevia CVE List