ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-835"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106568.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.2-32"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "e4f7ad983df6c831832eba3689f96b75f8b67051"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "7.1.2-32",
"range": [
{
"fixed": "ad98b244c995d2e3051757fa3b7855f45b550d24"
}
],
"source": "REFERENCES_TAG"
}
]
}
{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.9.13-57"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "27e36ca5cb446664bfc284d28d91fced8887b025"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "6.9.13-57",
"range": [
{
"fixed": "5e22284eaf96976b6d3c7c7f45231a813e4cd774"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-106568.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "107483943848657055083734487149112560682",
"length": 6276
},
"id": "CVE-2026-106568-3a4f12df",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051",
"target": {
"file": "MagickCore/xml-tree.c",
"function": "ParseInternalDoctype"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "133306942326428285031142578678317496451",
"length": 3228
},
"id": "CVE-2026-106568-6b00f704",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051",
"target": {
"file": "MagickCore/xml-tree.c",
"function": "ParseEntities"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137893941235921222807645954912786819765",
"length": 687
},
"id": "CVE-2026-106568-8f436e52",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051",
"target": {
"file": "MagickCore/xml-tree.c",
"function": "ValidateEntities"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "107483943848657055083734487149112560682",
"length": 6276
},
"id": "CVE-2026-106568-90f7e6d5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025",
"target": {
"file": "magick/xml-tree.c",
"function": "ParseInternalDoctype"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"31228830797231750770940555337405074396",
"19571842477815483829640138120020573824",
"259241588926783550829804440196078086430",
"129175117563807350005312835519073023476",
"281188854390185008613650468146590178653",
"330883383584930807807762619691208101099",
"286766272518984169806694000354460238052",
"56837590603362153822774536741084617",
"305414461072690781221475843437237892043",
"99999218197188288049225601472549810204",
"188703296833849273222285032413618683798",
"305944005149111005320232631289726570551",
"230863147894659468453009669676070665506",
"340124843918556179816569572319418154587",
"2396317753829315685807375505245108124",
"284863877760604945214603440991769276917",
"163416715525717077893191128557990915622",
"62212061525638201662250438927180769748",
"334371095750466314385514143862241311625",
"82205240700094064331080887487150898043",
"240755726828241737480296125673994283732",
"120940818502862229527778514642744422540",
"290406670813767547780529818467522438085"
],
"threshold": 0.9
},
"id": "CVE-2026-106568-a76e9150",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025",
"target": {
"file": "magick/xml-tree.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"40839256190811296803507257542512192741",
"67163376293278342040579469732639530972",
"18423554510479603767792848099193673013",
"31651248102500873388845938646676957082",
"211693428662969657699847816571328557771",
"76986186821716773862202493980484970289",
"31228830797231750770940555337405074396",
"19571842477815483829640138120020573824",
"259241588926783550829804440196078086430",
"129175117563807350005312835519073023476",
"281188854390185008613650468146590178653",
"330883383584930807807762619691208101099",
"286766272518984169806694000354460238052",
"56837590603362153822774536741084617",
"305414461072690781221475843437237892043",
"99999218197188288049225601472549810204",
"188703296833849273222285032413618683798",
"305944005149111005320232631289726570551",
"230863147894659468453009669676070665506",
"340124843918556179816569572319418154587",
"2396317753829315685807375505245108124",
"284863877760604945214603440991769276917",
"163416715525717077893191128557990915622",
"62212061525638201662250438927180769748",
"334371095750466314385514143862241311625",
"82205240700094064331080887487150898043",
"240755726828241737480296125673994283732",
"120940818502862229527778514642744422540",
"290406670813767547780529818467522438085"
],
"threshold": 0.9
},
"id": "CVE-2026-106568-d93742ba",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051",
"target": {
"file": "MagickCore/xml-tree.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137893941235921222807645954912786819765",
"length": 687
},
"id": "CVE-2026-106568-eea6965d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025",
"target": {
"file": "magick/xml-tree.c",
"function": "ValidateEntities"
}
}
]
"2026-10-16T10:09:55Z"