CVE-2026-109269: ImageMagick JPEG Decoder Disclosure Flaw

CVE-2026-109269 Overview

CVE-2026-109269 is an information disclosure vulnerability in ImageMagick's JPEG decoder. The flaw affects ImageMagick versions before 6.9.13-57 and 7.x versions before 7.1.2-32. The decoder performs an out-of-bounds read [CWE-125] that exposes uninitialized memory when processing crafted JPEG input. Attackers can supply a malicious JPEG file to leak uninitialized memory contents from the processing host.

Because ImageMagick is widely embedded in web upload pipelines, content management systems, and image processing services, the vulnerability is reachable through standard image submission interfaces without authentication.

Critical Impact
Remote, unauthenticated attackers can disclose uninitialized process memory by submitting a crafted JPEG file to any service that invokes the ImageMagick JPEG decoder.

Affected Products

ImageMagick versions prior to 6.9.13-57
ImageMagick 7.x versions prior to 7.1.2-32
Applications and services that embed vulnerable ImageMagick builds for JPEG processing

Discovery Timeline

2026-10-12 - CVE-2026-109269 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109269

Vulnerability Analysis

The defect lives in coders/jpeg.c, which handles JPEG decoding. The decoder generates a sampling factor string by reading h_samp_factor and v_samp_factor fields for four fixed comp_info entries. JPEG images, however, may contain fewer than four components. When the file declares a lower component count, the code still reads indexes [1], [2], and [3] of the comp_info array, pulling uninitialized stack or heap memory into the formatted output string.

That output is subsequently exposed through image metadata and log channels, making the leaked bytes retrievable by the attacker. Classified under [CWE-125] (Out-of-Bounds Read), the issue requires no authentication and no user interaction beyond submitting the crafted image.

Root Cause

The root cause is a hard-coded assumption that four JPEG components always exist. The fix replaces the fixed four-component format string with a loop bounded by jpeg_info->num_components, ensuring only initialized component entries are read.

Attack Vector

Exploitation requires network-reachable processing of attacker-supplied JPEG files. Any application that routes uploads to ImageMagick, including thumbnail generators, avatar processors, document conversion pipelines, and preview services, is a viable entry point. The attacker crafts a JPEG with a component count below four and retrieves the leaked memory from returned metadata or server-side logs that reflect the sampling factor string.

// Patch excerpt from coders/jpeg.c - loop bounded by num_components
     }
     default:
     {
+      size_t
+        length;
+
+      ssize_t
+        i;
+
       (void) LogMagickEvent(CoderEvent,GetMagickModule(),"Colorspace: %d",
         jpeg_info->out_color_space);
-      (void) FormatLocaleString(sampling_factor,MagickPathExtent,
-        "%dx%d,%dx%d,%dx%d,%dx%d",jpeg_info->comp_info[0].h_samp_factor,
-        jpeg_info->comp_info[0].v_samp_factor,
-        jpeg_info->comp_info[1].h_samp_factor,
-        jpeg_info->comp_info[1].v_samp_factor,
-        jpeg_info->comp_info[2].h_samp_factor,
-        jpeg_info->comp_info[2].v_samp_factor,
-        jpeg_info->comp_info[3].h_samp_factor,
-        jpeg_info->comp_info[3].v_samp_factor);
+      (void) FormatLocaleString(sampling_factor,MagickPathExtent,"%dx%d",
+        jpeg_info->comp_info[0].h_samp_factor,
+        jpeg_info->comp_info[0].v_samp_factor);
+      length=strlen(sampling_factor);
+      for (i=1; (i < (ssize_t) jpeg_info->num_components) && (length < MagickPathExtent); i++)
+      {
+        (void) FormatLocaleString(sampling_factor+length,MagickPathExtent-
+          length,",%dx%d",jpeg_info->comp_info[i].h_samp_factor,
+          jpeg_info->comp_info[i].v_samp_factor);
+         length+=strlen(sampling_factor+length);

Source: ImageMagick commit aa104ff2

Detection Methods for CVE-2026-109269

Indicators of Compromise

JPEG uploads with a num_components value below four combined with unusual or malformed Start of Frame (SOF) markers.
Image metadata responses containing non-printable or random byte sequences in the sampling factor field.
ImageMagick coder log entries referencing JPEG colorspace processing immediately before metadata is returned to a remote client.

Detection Strategies

Inventory installed ImageMagick packages across build hosts, containers, and application servers; flag versions below 6.9.13-57 and 7.1.2-32.
Inspect application endpoints that return EXIF, IPTC, or sampling-factor fields derived from identify or convert output to users.
Hunt in software composition analysis (SCA) results for transitive dependencies that bundle vulnerable ImageMagick builds.

Monitoring Recommendations

Alert on repeated upload attempts of small, structurally anomalous JPEG files from a single source IP or account.
Monitor image processing worker logs for coder events paired with abnormal MagickPathExtent string outputs.
Track outbound responses from image processing services for high entropy in metadata fields that should contain fixed-format sampling factor strings.

How to Mitigate CVE-2026-109269

Immediate Actions Required

Upgrade ImageMagick to 6.9.13-57 or later for the 6.x branch, or 7.1.2-32 or later for the 7.x branch.
Rebuild and redeploy container images, serverless functions, and application bundles that statically link or vendor ImageMagick.
Review and sanitize application responses to strip ImageMagick-derived metadata fields until all hosts are patched.

Patch Information

Upstream patches are available in the official repositories: ImageMagick 7.x commit aa104ff2 and ImageMagick 6.x commit acf52477. Full technical context is published in GitHub Security Advisory GHSA-xxrx-rjp3-27rj and the VulnCheck advisory.

Workarounds

Disable the JPEG coder in policy.xml where JPEG processing is non-essential by adding a policy entry that denies the JPEG coder.
Validate uploaded images with a lightweight parser that enforces a num_components value of three or four before passing files to ImageMagick.
Suppress exposure of ImageMagick-derived metadata, including the sampling factor field, in all API responses and user-facing output.

bash

# /etc/ImageMagick-7/policy.xml - restrict JPEG coder as a temporary workaround
<policymap>
  <policy domain="coder" rights="none" pattern="JPEG" />
  <policy domain="coder" rights="none" pattern="JPG" />
</policymap>