ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-409"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107210.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.2-30"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "7.1.2-30",
"range": [
{
"fixed": "344e9056f43764bfdf82456faf3bc2feee98a6fe"
}
],
"source": "REFERENCES_TAG"
}
]
}
{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.9.13-55"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "7d8e0eb11804a5ce5322ea317dfd3557cded4e7b"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "6.9.13-55",
"range": [
{
"fixed": "96c8a2e0f7d85639d7232bf02632b2edca707df1"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-107210.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"102294753142985881873094578507657450043",
"330395447124210240006120673510087564704",
"15901885546460951879657431965327453093",
"111125931512058649332898352486491510767",
"265172196016232604556511646170651153284",
"212551185034688961138914349309139088934",
"283316772726622967813265491746771710860",
"221250741793649684622173179025831355354",
"87898836162152265951327057911105435097",
"172341337203457711343363985987498019844",
"83425523811858993330061761784056876126",
"339050805766388943458012799243344627776",
"131280443029985884553634553370913057504",
"81219133345488905032011208019281880248",
"338609554316278978009133567903994214149",
"108796001251447734528009683715289063169",
"120983975079260545112398085112934475676",
"119842198153940940708715332045423943094",
"209066883346736932179206588747436190715",
"279431633587428510191070897352092851756",
"253374752551961245742152907697912131479",
"86149937535004757298593986698193982297",
"64818156761280033481355397795346842635",
"233463262735421170308406632565973087265",
"292497579859126887988633462267192613834",
"339233805402782409687659267439460314801",
"268100635146207140429715951890872427182",
"168786863142210314018903598272893153552",
"181248901506041722761774339507271738483",
"337972509260997269908994594084542099461",
"161345136730551301204696180783945987003",
"37823191005547276658159804431788934346",
"25370256867899751296657835206940249999",
"324899046980810626597640333585587106592",
"119328060132527766498496511363103020775",
"210029646684877924856514215869132323721",
"66934876765838765306703779092726738881",
"237315223273109473730979389877016831244",
"12813934705030057438712949960030944141",
"201798015387614947288749342890374623518",
"231426952522525107957444881335771554178",
"29232521072031100016965519491959935530",
"275848855012221160230886437425157450375",
"55190668591794681783145160219804486261",
"93820816887179008650566513769071347986",
"285026742115694486287739131964463050769",
"75279100618219506587345176062868473631",
"91726010160916884140647684504879489881",
"86772492244871059216745705076862735234",
"74276865879702483808180725520730014828",
"162775340736591288267539379971365746464",
"148454849617545856791501568253686474954",
"116441736485604652639495671929406317954",
"46866351635744649968761098245656722803",
"175009531737418615681696464447992415060",
"330627617084036616465890579399400838344",
"149475253365741870139479500702428018270",
"162655500112262363344844263759710124117",
"270650496311015524894994428001663596794",
"40315968757553935925646529051637395857",
"160032576832598497167829800299859264437",
"49407657727449689357394951566924929502",
"163696423914506440134939234849638500555"
],
"threshold": 0.9
},
"id": "CVE-2026-107210-23ca055e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61",
"target": {
"file": "coders/mat.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "100283819959719274126374740369572393715",
"length": 2688
},
"id": "CVE-2026-107210-91f371da",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b",
"target": {
"file": "coders/mat.c",
"function": "decompress_block"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"102294753142985881873094578507657450043",
"330395447124210240006120673510087564704",
"15901885546460951879657431965327453093",
"111125931512058649332898352486491510767",
"273294393453158522339311362838794227668",
"172273938654309495898393808572617285240",
"87399529083664857799696060975289518605",
"49768142979780164519284689827021531565",
"273123475725334804550397166442276638904",
"16198094017551717402268325899527571903",
"10994983606160921338792799428976872983",
"51414024547258562658317315337648442845",
"89154564465214149027273538152604374917",
"183730710212872747248444086202846984747",
"315434004578118534812302887950003142538",
"87898836162152265951327057911105435097",
"172341337203457711343363985987498019844",
"83425523811858993330061761784056876126",
"339050805766388943458012799243344627776",
"131280443029985884553634553370913057504",
"81219133345488905032011208019281880248",
"338609554316278978009133567903994214149",
"108796001251447734528009683715289063169",
"120983975079260545112398085112934475676",
"119842198153940940708715332045423943094",
"209066883346736932179206588747436190715",
"279431633587428510191070897352092851756",
"253374752551961245742152907697912131479",
"86149937535004757298593986698193982297",
"64818156761280033481355397795346842635",
"8308262829269592787550604538213024855",
"324352599327056923003841021444841857836",
"259644683410346137729939609558283802021",
"104646446121564352015227461349938784896",
"339233805402782409687659267439460314801",
"268100635146207140429715951890872427182",
"168786863142210314018903598272893153552",
"181248901506041722761774339507271738483",
"337972509260997269908994594084542099461",
"161345136730551301204696180783945987003",
"37823191005547276658159804431788934346",
"25370256867899751296657835206940249999",
"324899046980810626597640333585587106592",
"119328060132527766498496511363103020775",
"210029646684877924856514215869132323721",
"66934876765838765306703779092726738881",
"237315223273109473730979389877016831244",
"12813934705030057438712949960030944141",
"201798015387614947288749342890374623518",
"231426952522525107957444881335771554178",
"29232521072031100016965519491959935530",
"275848855012221160230886437425157450375",
"55190668591794681783145160219804486261",
"93820816887179008650566513769071347986",
"285026742115694486287739131964463050769",
"75279100618219506587345176062868473631",
"91726010160916884140647684504879489881",
"86772492244871059216745705076862735234",
"74276865879702483808180725520730014828",
"163377830770152243598141540687637426152",
"228043725243630550342098561779610821403",
"48790926696454021602523100729815984028",
"248062603399967165291284591759122630782",
"175009531737418615681696464447992415060",
"330627617084036616465890579399400838344",
"149475253365741870139479500702428018270",
"162655500112262363344844263759710124117",
"270650496311015524894994428001663596794",
"24003518054507106523681121684239198531",
"303433569183763355186939574218788483139",
"137100567566258790987172285338039403654",
"309034051806421629079332660045075998706",
"184969777649280017687069560524937795579",
"180025194954474754969548012429610442365",
"1452302764363205666326044283576149402",
"275039309254639011429330377149545072983",
"111519820520183060942845338092027574592",
"111392765422504138736158550996498404193",
"313333176520765159787014146985311712227",
"165369195418063144240826750895124371079",
"40315968757553935925646529051637395857",
"160032576832598497167829800299859264437",
"49407657727449689357394951566924929502",
"163696423914506440134939234849638500555"
],
"threshold": 0.9
},
"id": "CVE-2026-107210-967e4000",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b",
"target": {
"file": "coders/mat.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "208138291358494243983973832225825030204",
"length": 2777
},
"id": "CVE-2026-107210-d5802356",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61",
"target": {
"file": "coders/mat.c",
"function": "decompress_block"
}
}
]
"2026-10-16T07:22:23Z"