CVE-2026-109273: ImageMagick Information Disclosure Flaw

CVE-2026-109273 Overview

CVE-2026-109273 is an information disclosure vulnerability in ImageMagick's PostScript decoder. The flaw affects ImageMagick versions before 6.9.13-57 and 7.x versions before 7.1.2-32. The PostScript decoder allocates a buffer one byte longer than the data it actually decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents from the processing host. The vulnerability maps to CWE-908: Use of Uninitialized Resource. It is network-reachable through any application that passes untrusted PostScript input to ImageMagick, including image processing services and content pipelines.

Critical Impact
A crafted PostScript file leaks one uninitialized byte of process memory per decode operation, which attackers can repeat to collect sensitive data.

Affected Products

ImageMagick 6.x before 6.9.13-57
ImageMagick 7.x before 7.1.2-32
Downstream applications and services that embed vulnerable ImageMagick builds for PostScript decoding

Discovery Timeline

2026-10-12 - CVE-2026-109273 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109273

Vulnerability Analysis

The vulnerability resides in coders/ps.c, the PostScript decoder in ImageMagick. During ICC profile extraction, the decoder reads bytes from a PostScript stream into a StringInfo buffer. The code then sets the final length of the buffer to i+1 instead of i, where i is the count of bytes actually written. The trailing byte is never initialized by the decoder. When ImageMagick serializes the ICC profile into output image metadata, that extra byte is included and reveals heap contents from the ImageMagick process.

Each crafted input yields one uninitialized byte. Attackers who can submit many files, such as through an upload endpoint or a batch conversion service, can accumulate memory bytes over time. Leaked content may include fragments of other image buffers, configuration data, or keys residing in heap memory. The issue impacts confidentiality only; integrity and availability are not directly affected.

Root Cause

The root cause is an off-by-one length assignment in the ICC profile handler of coders/ps.c. The decoder tracks the number of valid bytes read in i, then calls SetStringInfoLength(ps_info->icc_profile,(size_t) i+1). The +1 extends the logical length past the last byte written, so the trailing byte returned from the allocator is treated as decoded content. This matches the CWE-908 pattern of consuming an uninitialized resource.

Attack Vector

Exploitation requires an attacker to deliver a crafted PostScript file to a system that uses ImageMagick's PS decoder. Any workflow that accepts PostScript, EPS, or PDF-derived input and returns processed image metadata is a candidate. The attacker then reads the serialized ICC profile from the output image to recover the leaked byte. No authentication or user interaction is required when the target service accepts anonymous uploads.

// Patch excerpt from coders/ps.c (ImageMagick6)
// Source: https://github.com/ImageMagick/ImageMagick6/commit/a32215ba7a193f2bc896ba6ed4be4013cc06e22b
            datum[i]=(unsigned char) c;
          }
-        SetStringInfoLength(ps_info->icc_profile,(size_t) i+1);
+        SetStringInfoLength(ps_info->icc_profile,(size_t) i);
          if (c == EOF)
            break;

The fix removes the +1, so the profile length matches the number of bytes actually written. A companion commit in ImageMagick 7 applies the same hardening path to the 7.x decoder.

Detection Methods for CVE-2026-109273

Indicators of Compromise

Repeated uploads of small PostScript, EPS, or PDF files that produce output images containing non-standard or malformed ICC profiles.
Output images whose embedded ICC profile size is one byte larger than the decoded profile payload.
Spikes in PostScript decode operations from a single source identity or IP against image conversion endpoints.

Detection Strategies

Inventory ImageMagick binaries and libraries across servers, containers, and build images, then compare versions against 6.9.13-57 and 7.1.2-32.
Enable ImageMagick policy logging and watch for the PS, EPS, and PDF coder modules being invoked by services that do not require them.
Correlate web application upload telemetry with child process execution of convert, magick, or gs to identify PostScript decoding paths.

Monitoring Recommendations

Alert on anomalous volumes of PostScript-family uploads per account or IP within short windows.
Monitor process trees where image processing services spawn Ghostscript or ImageMagick with PostScript inputs from untrusted sources.
Track egress of processed image metadata to external destinations, especially where output images are returned directly to anonymous users.

How to Mitigate CVE-2026-109273

Immediate Actions Required

Upgrade ImageMagick to 6.9.13-57 or 7.1.2-32 or later across all hosts, container images, and CI pipelines.
Disable the PS, EPS, and PDF coders in policy.xml on systems that do not need PostScript decoding.
Audit public-facing upload endpoints and reject PostScript-family MIME types where they are not required.

Patch Information

The maintainers released fixes in two commits. ImageMagick 7.x is patched in commit 5a5c2e5, and ImageMagick 6.x is patched in commit a32215b. Full details are available in GitHub Security Advisory GHSA-5j8x-vq8c-vrp9 and the VulnCheck Advisory.

Workarounds

Restrict ImageMagick coder modules in policy.xml to deny PS, EPS, PDF, and XPS until patched builds are deployed.
Place image conversion workloads behind an input validation layer that rejects PostScript magic bytes when not required.
Run ImageMagick with a dedicated low-privilege account in an isolated container so leaked heap bytes contain no secrets of value.

bash

# Example policy.xml hardening to block PostScript-family decoders
# File: /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="PS" />
  <policy domain="coder" rights="none" pattern="PS2" />
  <policy domain="coder" rights="none" pattern="PS3" />
  <policy domain="coder" rights="none" pattern="EPS" />
  <policy domain="coder" rights="none" pattern="PDF" />
  <policy domain="coder" rights="none" pattern="XPS" />
</policymap>