CVE-2026-109276: ImageMagick JNG Decoder DOS Vulnerability

CVE-2026-109276 Overview

CVE-2026-109276 is an incomplete cleanup vulnerability [CWE-459] in the ImageMagick JNG (JPEG Network Graphics) decoder. The flaw affects ImageMagick versions before 6.9.13-57 and 7.x versions before 7.1.2-32. When the decoder processes crafted JNG files, it fails to remove temporary files from disk. Attackers who can submit images to a vulnerable processing pipeline can trigger repeated temporary file creation that is never cleaned up. Over time, these leaked files consume disk space and degrade service availability. The vulnerability is reachable over the network wherever ImageMagick processes untrusted image input, including web upload handlers and automated conversion workflows.

Critical Impact
Repeated submission of crafted JNG files leaks temporary files, exhausting disk capacity and causing denial of service on hosts running vulnerable ImageMagick builds.

Affected Products

ImageMagick versions before 6.9.13-57
ImageMagick 7.x versions before 7.1.2-32
Applications and services that invoke the ImageMagick JNG decoder on untrusted input

Discovery Timeline

2026-10-12 - CVE-2026-109276 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109276

Vulnerability Analysis

The defect lives in the PNG/JNG decoder in coders/png.c. During JNG decoding, ImageMagick allocates separate Image structures for the color channel and the alpha channel. Each of these images is backed by a temporary file on disk when the pixel cache spills out of memory. When the decoder reached its cleanup path, it destroyed the in-memory Image list but did not release the associated unique file resource. Repeated processing of crafted JNG inputs left orphaned temporary files on disk.

Root Cause

The root cause is a missing call to RelinquishUniqueFileResource on the color_image and alpha_image structures before DestroyImageList. Because file cleanup is tied to the resource tracker rather than DestroyImageList, bypassing the tracker leaked the underlying file on disk. The condition is categorized as [CWE-459] Incomplete Cleanup.

Attack Vector

Exploitation requires only that an attacker submit a crafted JNG file to a service that invokes ImageMagick. No authentication or user interaction is needed when the processing endpoint is anonymous. The impact is limited to availability: attackers do not gain code execution or data access, but they can fill the disk partition hosting the temporary directory and degrade or halt the service.

  }
  if (color_image && *color_image)
  {
+   if ((*color_image)->filename != '\0')
+     (void) RelinquishUniqueFileResource((*color_image)->filename);
    DestroyImageList(*color_image);
    *color_image = (Image *)NULL;
  }
  if (alpha_image && *alpha_image)
  {
+   if ((*alpha_image)->filename != '\0')
+     (void) RelinquishUniqueFileResource((*alpha_image)->filename);
    DestroyImageList(*alpha_image);
    *alpha_image = (Image *)NULL;
  }

Source: ImageMagick6 commit 3875281

Detection Methods for CVE-2026-109276

Indicators of Compromise

Growing count of files in the ImageMagick temporary directory (default /tmp or the path set by MAGICK_TMPDIR) that persist after conversion jobs complete.
Rapid disk usage growth on hosts running image-processing services, especially after bursts of JNG uploads.
Service errors referencing No space left on device originating from processes that invoke convert, magick, or PerlMagick.

Detection Strategies

Audit the installed ImageMagick version with magick -version or convert -version and compare against 6.9.13-57 and 7.1.2-32.
Inspect web and API logs for repeated uploads of files with .jng extension or MIME type image/x-jng from a single source.
Correlate disk-usage spikes with image-processing activity to identify abuse patterns.

Monitoring Recommendations

Alert on temporary directory file counts or size thresholds specific to the ImageMagick working directory.
Monitor the exit status of ImageMagick worker processes for disk-related failures.
Track inbound image uploads by format and source IP to surface anomalous JNG submission rates.

How to Mitigate CVE-2026-109276

Immediate Actions Required

Upgrade ImageMagick to 6.9.13-57 or later for the 6.x branch, or 7.1.2-32 or later for the 7.x branch.
Restrict accepted image formats at the application layer and reject JNG input where it is not a business requirement.
Rate-limit image upload endpoints and apply per-user quotas to limit abuse of the processing pipeline.

Patch Information

The fix is published in the upstream commits for both branches. For ImageMagick 7, see ImageMagick commit b2d579d. For ImageMagick 6, see ImageMagick6 commit 3875281. Additional context is available in the GitHub Security Advisory GHSA-f983-243h-9x4r and the Vulncheck advisory.

Workarounds

Disable the JNG decoder in policy.xml with a rule such as <policy domain="coder" rights="none" pattern="JNG" /> until patches are deployed.
Place the ImageMagick temporary directory on a dedicated filesystem with a size cap to contain disk exhaustion.
Run image processing in short-lived containers that are destroyed after each job, discarding any leaked temporary files.

bash

# Restrict the JNG coder in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="JNG" />
</policymap>

# Isolate the ImageMagick temp directory on a size-capped mount
export MAGICK_TMPDIR=/var/imagemagick/tmp