CVE-2026-109268: ImageMagick Use After Free Vulnerability

CVE-2026-109268 Overview

CVE-2026-109268 is a use-after-free vulnerability [CWE-416] in ImageMagick's PDF writer. The flaw affects ImageMagick versions before 6.9.13-57 and 7.x versions before 7.1.2-32. It occurs when the library writes CMYK images to PDF using JPEG2000 compression. A crafted CMYK input image causes freed memory to be reused during PDF object counting, leading to process instability. The vulnerability resides in coders/pdf.c, specifically in the image list iteration that handles ICC color profiles alongside JPEG2000 compression. Attackers who can supply or influence images processed by vulnerable ImageMagick deployments can trigger the condition remotely.

Critical Impact
Successful exploitation causes a process crash through memory corruption, resulting in denial of service for applications or services performing automated PDF conversion.

Affected Products

ImageMagick versions before 6.9.13-57
ImageMagick 7.x versions before 7.1.2-32
Applications and services embedding vulnerable ImageMagick for PDF export with JPEG2000 compression

Discovery Timeline

2026-10-12 - CVE-2026-109268 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109268

Vulnerability Analysis

The vulnerability stems from how ImageMagick's PDF coder tracks object references when iterating over image lists. During PDF generation, the writer increments an object counter based on whether an ICC color profile is attached to each image. The pre-patch logic did not account for the interaction between JPEG2000 compression and non-sRGB colorspaces such as CMYK. This mismatch caused the writer to reference memory associated with a color profile that was released earlier in the processing path. Writing a CMYK image with JPEG2000 compression triggers the inconsistent accounting, allowing freed memory to be reused later in the PDF emission sequence.

Root Cause

The root cause is a missing compression and colorspace check before counting ICC profile objects in the PDF output. The affected loop in coders/pdf.c incremented object counts whenever an ICC profile existed, without validating that the profile applies to the image under the chosen compression method. For CMYK images with JPEG2000 compression, the ICC profile buffer is released by the compression path, but the PDF counter still assumes it is live, producing a use-after-free when subsequent code dereferences it.

Attack Vector

An attacker provides a crafted CMYK image to any workflow that converts images to PDF using JPEG2000 compression through ImageMagick. Typical exposure paths include file upload endpoints, automated conversion pipelines, document generation services, and command-line batch processing. No authentication or user interaction is required when the processing service accepts untrusted input. The outcome is a crash of the ImageMagick process, affecting availability of the hosting application.

       kid_image=image;
       for ( ; GetNextImageInList(kid_image) != (Image *) NULL; count+=ObjectsPerImage)
       {
+        CompressionType
+          kid_compression;
+
         page_count++;
+        kid_compression=kid_image->compression;
+        if (image_info->compression != UndefinedCompression)
+          kid_compression=image_info->compression;
         icc_profile=GetCompatibleColorProfile(kid_image);
-        if (icc_profile != (StringInfo *) NULL)
+        if ((icc_profile != (StringInfo *) NULL) &&
+            ((kid_compression != JPEG2000Compression) ||
+             (IssRGBCompatibleColorspace(kid_image->colorspace) != MagickFalse)))
           count+=2;
         (void) FormatLocaleString(buffer,MagickPathExtent,"%.17g 0 R ",(double)
           count);
// Source: https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54

The patch adds a kid_compression variable and skips the ICC profile object count when JPEG2000 compression is combined with a non-sRGB-compatible colorspace, preventing the stale pointer dereference.

Detection Methods for CVE-2026-109268

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes invoking ImageMagick's convert, magick, or library APIs when outputting PDF
Core dumps referencing coders/pdf.c frames during CMYK-to-PDF conversion
Spike in failed PDF conversion jobs following receipt of externally supplied CMYK images

Detection Strategies

Inventory installed ImageMagick packages across hosts and compare against 6.9.13-57 and 7.1.2-32 thresholds
Monitor application logs for ImageMagick exceptions correlated with uploads containing CMYK colorspace or JP2/JPX inputs
Instrument conversion workloads with AddressSanitizer or Valgrind in staging to confirm patch state before production rollout

Monitoring Recommendations

Alert on repeated image processing worker restarts or container exits in document pipelines
Capture process telemetry for any binary spawning magick or convert with -compress JPEG2000 arguments
Track inbound uploads carrying CMYK color profile metadata to high-value PDF generation services

How to Mitigate CVE-2026-109268

Immediate Actions Required

Upgrade ImageMagick to 6.9.13-57 or later for the 6.x branch, or 7.1.2-32 or later for the 7.x branch
Audit all services and container images that bundle ImageMagick and schedule rebuilds against patched upstream versions
Validate inputs to PDF conversion endpoints and reject or sanitize untrusted CMYK images where feasible

Patch Information

The vendor fix is published in the ImageMagick 7.x commit and the ImageMagick 6 commit. Additional context is available in the GitHub Security Advisory GHSA-j39j-wmxg-j8mv and the VulnCheck advisory.

Workarounds

Disable JPEG2000 compression in PDF output by overriding -compress with a different algorithm such as Zip or LZW
Restrict policy via policy.xml to block the JP2 and JPX coders and the PDF writer where PDF export is not required
Convert CMYK inputs to sRGB before invoking the PDF writer to avoid the vulnerable code path

bash

# Restrict vulnerable coders in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="JP2" />
  <policy domain="coder" rights="none" pattern="JPX" />
  <policy domain="coder" rights="read|write" pattern="PDF" />
</policymap>

# Force non-JPEG2000 compression for PDF output
magick input.tiff -colorspace sRGB -compress Zip output.pdf