CVEvulnerability
CVE-2026-109276
6.9 MEDIUM
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-10-12
- Last modified
- 2026-10-18
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-459
Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.
Related
Weakness · CWE (1)
- CWE-459 Incomplete Cleanup weakness
References
- https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a github.com
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r github.com
- https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b github.com
- https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder www.vulncheck.com