CVE-2026-109276GHSA-f983-243h-9x4r
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
ImageMagick ImageMagickLibraries & packages
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.
Text from CVE List
Affected versions 4
- ImageMagickaffected: 7.0.0-0 before 7.1.2-32CVE List
- ImageMagickunaffected: 7.1.2-32CVE List
- ImageMagickaffected: all versions before 6.9.13-57CVE List
- ImageMagickunaffected: 6.9.13-57CVE List
References 4
- github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58aFixvia CVE List
- github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3bFixvia CVE List
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4rAdvisoryvia CVE List
- vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoderAdvisoryvia CVE List