CVE-2026-102635: ImageMagick GIF Decoder Information Disclosure

CVE-2026-102635 Overview

CVE-2026-102635 is an uninitialized memory use vulnerability [CWE-908] in ImageMagick's GIF decoder. The flaw resides in the application extension handler in coders/gif.c. Attackers can craft malicious GIF files that trigger the number parser to read uninitialized heap memory. The decoder then stores that memory content as image metadata, exposing sensitive heap contents to whoever processes the resulting image.

Affected versions include ImageMagick releases before 7.1.2-32 and before 6.9.13-57. The issue affects any application, service, or automated pipeline that processes untrusted GIF files with a vulnerable ImageMagick build.

Critical Impact
Attackers can extract sensitive heap data — such as cryptographic material, session tokens, or fragments of other processed files — by submitting crafted GIF images to image-processing endpoints.

Affected Products

ImageMagick versions before 7.1.2-32
ImageMagick versions before 6.9.13-57
Downstream applications and services embedding vulnerable ImageMagick builds for GIF processing

Discovery Timeline

2026-09-29 - CVE-2026-102635 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102635

Vulnerability Analysis

The defect lives in the GIF application extension handler in coders/gif.c, in the code path that parses numeric fields inside extension blocks. The parser processes bytes from the extension buffer without confirming that every byte read was initialized from the input file. When the parser encounters malformed length or field values, it reads from heap regions that were never populated with attacker-supplied data.

ImageMagick then copies the parsed value into image metadata associated with the decoded GIF. That metadata is retrievable through normal API calls and appears in output artifacts such as identify results, sidecar files, or converted images. Any consumer that inspects the metadata receives the leaked heap bytes.

Because the leak surfaces through routine metadata handling, exploitation requires no memory-corruption primitive. The attacker simply supplies a crafted GIF and reads the metadata back. See the GitHub Security Advisory GHSA-rvv7-5mh8-vcfc for advisory details.

Root Cause

The root cause is missing initialization and insufficient bounds validation in the GIF application extension number parser. Reference the vulnerable code segment in coders/gif.c for the pre-patch logic. The parser trusted its working buffer without verifying that read positions corresponded to bytes actually loaded from the input.

Attack Vector

An attacker uploads or submits a crafted GIF to any workflow that invokes vulnerable ImageMagick to decode the file. Common exposure points include image upload endpoints, thumbnail generators, document conversion pipelines, and content management systems. After processing, the attacker retrieves the disclosed heap contents from image metadata fields returned by the service.

Detection Methods for CVE-2026-102635

Indicators of Compromise

GIF files containing malformed or oversized application extension blocks submitted to image-processing endpoints
Unexpected or non-printable byte sequences appearing in stored image metadata fields after GIF conversion
Repeated GIF uploads from a single source followed by metadata retrieval requests targeting the same objects

Detection Strategies

Inventory installed ImageMagick versions across servers and container images and flag any build older than 7.1.2-32 or 6.9.13-57
Inspect application logs for GIF processing errors or anomalous metadata values emitted by identify, convert, or magick invocations
Instrument upload handlers to sample and analyze GIF application extension blocks for structural anomalies

Monitoring Recommendations

Alert on high-volume GIF uploads followed by metadata read operations from the same session or IP address
Monitor process execution telemetry for ImageMagick binaries invoked on user-supplied content and correlate with vulnerable version fingerprints
Track outbound data flows from image-processing services for unexpected volumes of metadata being returned to external clients

How to Mitigate CVE-2026-102635

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-32 or later, or to 6.9.13-57 or later on the 6.x branch
Rebuild and redeploy container images and application bundles that embed ImageMagick libraries
Restrict GIF processing to trusted inputs until the upgrade is complete, and strip metadata from any converted images returned to end users

Patch Information

The fix is available in ImageMagick 7.1.2-32 via commit a0ca2c739c and in ImageMagick6 6.9.13-57 via commit 95dc0fd21a68. See the VulnCheck advisory for additional context and the ImageMagick GitHub repository for release artifacts.

Workarounds

Disable the GIF coder in ImageMagick policy configuration until patched builds are deployed
Pre-validate uploaded GIF files with an independent parser that rejects malformed application extension blocks
Sanitize or drop image metadata fields from responses returned by image-processing services so leaked heap bytes are not exposed to callers

bash

# Disable the GIF coder in /etc/ImageMagick-7/policy.xml until patched
# Add inside the <policymap> element:
# <policy domain="coder" rights="none" pattern="GIF" />

# Verify the installed ImageMagick version
magick -version

# On Debian/Ubuntu, upgrade the package once the fixed build is available
sudo apt update && sudo apt install --only-upgrade imagemagick