CVE-2026-109259: ImageMagick TGA Decoder Memory Disclosure

CVE-2026-109259 Overview

CVE-2026-109259 is an uninitialized memory read vulnerability in the Truevision TGA (.tga) image decoder of ImageMagick. Affected versions include ImageMagick before 6.9.13-57 and the 7.x branch before 7.1.2-32. An attacker who can submit a crafted TGA image for processing can trigger the decoder to read uninitialized stack memory. The leaked bytes may be returned in decoded image output or error paths, exposing data from the ImageMagick process address space. The weakness is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A crafted TGA file processed by a vulnerable ImageMagick build can disclose uninitialized process memory to a remote attacker, enabling information leakage in web services, document pipelines, and conversion workflows.

Affected Products

ImageMagick 6.x prior to 6.9.13-57
ImageMagick 7.x prior to 7.1.2-32
Applications and services that embed ImageMagick for TGA image processing

Discovery Timeline

2026-10-12 - CVE-2026-109259 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109259

Vulnerability Analysis

The flaw resides in coders/tga.c, the TGA image coder in ImageMagick. The decoder declares stack-allocated structures and buffers used to parse TGA header metadata and optional extension data without zero-initializing them. When the parser follows paths that leave fields unset — for example, when a crafted file omits or truncates optional extension sections — the subsequent read operations consume stack memory that was never written during the current decode.

Because the uninitialized bytes can propagate into image attributes, pixel values, or logged metadata, an attacker can harvest them by inspecting the resulting image output. In server environments that convert user-uploaded images, this provides a repeatable primitive to leak fragments of adjacent stack contents from the ImageMagick worker process.

Root Cause

The root cause is missing initialization of two stack objects in the TGA coder: the TGAInfo structure that holds parsed header fields, and a 325-byte buffer used to hold the optional TGA extension area read via ReadBlob. When control flow depends on fields or bytes that were never populated by the file, the decoder operates on residual stack data.

Attack Vector

Exploitation requires only that a vulnerable ImageMagick instance process an attacker-controlled TGA file. No authentication or user interaction is needed where image conversion is exposed as a service, such as file upload endpoints, thumbnail generators, or document rendering pipelines. The EPSS score at publication was 0.307% (percentile 21.98).

// Patch: coders/tga.c - initialize TGAInfo on the stack
     y;
 
   TGAInfo
-    tga_info;
+    tga_info = { 0 };
 
   unsigned char
     j,
// Source: https://github.com/ImageMagick/ImageMagick/commit/8e809498fd328256612ee9c0ff7941bd452a0285

// Patch: coders/tga.c - zero-initialize the TGA extension buffer
             Optional extension.
           */
           char
-            buffer[325];
+            buffer[325] = { 0 };
 
           (void) ReadBlob(image,41,buffer);
           buffer[41]='\0';
// Source: https://github.com/ImageMagick/ImageMagick/commit/df199b79f0a1c87ca009e431f03cb387af160f77

The ImageMagick 6 branch received an equivalent fix for TGAInfo initialization in commit 9c7c5f9f.

Detection Methods for CVE-2026-109259

Indicators of Compromise

Processing of unexpected or malformed .tga files submitted to image conversion endpoints, especially files with truncated or absent extension areas.
ImageMagick worker processes producing TGA output containing high-entropy regions that do not match the input image contents.
Repeated TGA conversion requests from a single source generating anomalous output sizes or decode warnings in logs.

Detection Strategies

Inventory ImageMagick installations and compare installed versions against 6.9.13-57 and 7.1.2-32 using package manifests or magick -version.
Instrument image processing pipelines to log the coder used for each conversion; alert on unexpected TGA activity in environments that do not accept TGA input.
Run decoded output through a memory sanitizer such as MemorySanitizer (MSan) in staging to confirm whether uninitialized reads reach the output.

Monitoring Recommendations

Monitor web application and API logs for .tga uploads and content-type image/x-targa requests, correlating with ImageMagick process activity.
Track ImageMagick stderr for TGA parsing warnings or non-zero exit codes from conversion workers.
Audit outbound responses from image-processing endpoints for unusually large or binary-dense payloads that could indicate leaked memory.

How to Mitigate CVE-2026-109259

Immediate Actions Required

Upgrade ImageMagick to 6.9.13-57 or 7.1.2-32 or later across all hosts, containers, and build images.
Restrict the ImageMagick coder set using policy.xml to disable TGA processing where it is not required.
Rebuild and redeploy any application artifacts that statically link or vendor ImageMagick libraries.

Patch Information

Fixes are available in the upstream commits 8e809498 and df199b79 for the 7.x branch, and 9c7c5f9f for ImageMagick 6. Additional context is published in GitHub Security Advisory GHSA-h499-883p-vph8 and the VulnCheck advisory.

Workarounds

Disable the TGA coder in /etc/ImageMagick-7/policy.xml until patches are deployed.
Validate uploaded file types using magic-byte inspection and reject TGA submissions at the application layer where feasible.
Isolate ImageMagick workers in sandboxed containers with reduced memory visibility to limit the value of leaked bytes.

bash

# Configuration example: disable the TGA coder in ImageMagick policy.xml
# Edit /etc/ImageMagick-7/policy.xml and add inside <policymap>:
#   <policy domain="coder" rights="none" pattern="TGA" />
#   <policy domain="coder" rights="none" pattern="VDA" />
#   <policy domain="coder" rights="none" pattern="ICB" />
#   <policy domain="coder" rights="none" pattern="VST" />

# Verify installed version meets the fixed release
magick -version | head -n 1

# Confirm the TGA coder is blocked
magick identify -list policy | grep -i tga