CVE-2026-109265: ImageMagick Heap Buffer Overflow Flaw

CVE-2026-109265 Overview

CVE-2026-109265 is a heap buffer over-read vulnerability in ImageMagick 7.1.1-7 before 7.1.2-32. The flaw resides in the XMP (Extensible Metadata Platform) profile parsing logic within MagickCore/profile.c. Incorrect string termination allows the parser to read past the bounds of an allocated heap buffer. Attackers can supply a crafted image containing a malformed XMP profile to trigger the condition. Successful exploitation crashes the ImageMagick process, producing a denial-of-service condition in any application or service that processes untrusted images with the vulnerable library. The issue is tracked under [CWE-125] Out-of-Bounds Read.

Critical Impact
A remote attacker can crash ImageMagick-powered image processing pipelines by submitting a single crafted image file containing a malformed XMP profile.

Affected Products

ImageMagick 7.1.1-7 (initial affected release)
ImageMagick 7.1.1-x through 7.1.2-31
Applications and web services embedding vulnerable ImageMagick builds

Discovery Timeline

2026-10-12 - CVE-2026-109265 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109265

Vulnerability Analysis

ImageMagick parses embedded XMP profiles when decoding image containers that carry metadata. The affected code path in MagickCore/profile.c extracts XMP values between start and end offsets, then processes the extracted substring. Because the routine does not guarantee proper null termination of the extracted value, downstream string operations read beyond the allocated heap region. The result is a heap buffer over-read that discloses adjacent memory or, more commonly, dereferences unmapped memory and aborts the process. Any pipeline that converts, thumbnails, or inspects user-supplied images with ImageMagick is reachable from the network when the image path is exposed through an upload endpoint.

Root Cause

The root cause is improper string termination in the ReplaceXmpValue helper used during XMP profile processing. When the function copies bytes bounded by start and end indices, it fails to enforce a trailing null byte on the destination buffer under certain malformed inputs. Subsequent string handling then relies on an unbounded scan, overrunning the heap allocation.

Attack Vector

Exploitation requires no authentication and no user interaction beyond the normal act of submitting an image. An attacker uploads or otherwise supplies a crafted image containing a malformed XMP metadata block to a service that invokes ImageMagick for decoding, conversion, or identification. The parser triggers the over-read during XMP handling, causing a process crash or abnormal termination.

   return;
 }
 
-static void ReplaceXmpValue(StringInfo *profile,size_t start,size_t end,
+static void ReplaceXMPValue(StringInfo *profile,size_t start,size_t end,
   const char *value)
 {
   char

Source: ImageMagick commit 7605c761. The upstream patch rewrites the XMP value replacement routine (renamed to ReplaceXMPValue) and corrects the string termination logic that produced the over-read.

Detection Methods for CVE-2026-109265

Indicators of Compromise

Unexpected crashes, segmentation faults, or SIGABRT events in processes invoking convert, magick, identify, or linked libMagickCore consumers.
Image upload requests containing anomalous or malformed XMP packets, particularly XMP blocks missing proper termination markers.
Repeated 5xx responses or worker restarts in web services whose image processing backend is ImageMagick.

Detection Strategies

Inventory all hosts and container images and identify ImageMagick versions between 7.1.1-7 and 7.1.2-31 using package managers or magick -version.
Instrument image processing services with crash reporting and correlate aborts with recently submitted image inputs.
Scan uploaded images with validators that reject XMP profiles failing schema and termination checks before passing them to ImageMagick.

Monitoring Recommendations

Monitor process-exit telemetry and core-dump creation on hosts running image processing workloads.
Alert on sudden spikes in image upload failures or converter worker restarts.
Track egress patterns from image processing hosts to detect follow-on activity if the over-read is paired with other flaws.

How to Mitigate CVE-2026-109265

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-32 or later across all production, staging, and build environments.
Rebuild and redeploy container images and application bundles that statically link or vendor ImageMagick.
Restrict direct exposure of image upload endpoints to the internet where feasible and apply rate limiting.

Patch Information

The fix is delivered in ImageMagick 7.1.2-32 via commit 7605c761. Review the GitHub Security Advisory GHSA-jph3-37cg-79wg and the VulnCheck ImageMagick advisory for distribution-specific packaging guidance.

Workarounds

Strip XMP metadata from inbound images before handing them to ImageMagick using a dedicated metadata sanitizer.
Use ImageMagick policy files to disable processing of untrusted profile types until the patched version is deployed.
Sandbox image processing workers with resource limits and automatic restart so that a crash does not degrade overall service availability.

bash

# /etc/ImageMagick-7/policy.xml - restrict profile handling
# Disable XMP profile processing until upgrade to 7.1.2-32
<policymap>
  <policy domain="module" rights="none" pattern="XMP" />
  <policy domain="coder" rights="none" pattern="XMP" />
</policymap>