CVE-2026-109265

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109265
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-109265.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-109265
Aliases
  • GHSA-jph3-37cg-79wg
Downstream
Related
Published
2026-10-12T16:04:33Z
Modified
2026-10-19T17:27:19Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile
Details

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109265.json"
}
References

Affected packages

Git / github.com/imagemagick/imagemagick

Affected ranges

Type
GIT
Repo
https://github.com/imagemagick/imagemagick
Events
Introduced
21d049b305ff00c77e168bad1085abb73b7f2201
Fixed
ad98b244c995d2e3051757fa3b7855f45b550d24
Fixed
7605c7619da77a5ff1ccf4ec159f3ec782c6bda7
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "7.1.1-7"
                },
                {
                    "fixed": "7.1.2-32"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "7605c7619da77a5ff1ccf4ec159f3ec782c6bda7"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

7.*
7.1.1-10
7.1.1-11
7.1.1-12
7.1.1-13
7.1.1-14
7.1.1-15
7.1.1-16
7.1.1-17
7.1.1-18
7.1.1-19
7.1.1-20
7.1.1-21
7.1.1-22
7.1.1-23
7.1.1-24
7.1.1-25
7.1.1-26
7.1.1-27
7.1.1-28
7.1.1-29
7.1.1-30
7.1.1-31
7.1.1-32
7.1.1-33
7.1.1-34
7.1.1-35
7.1.1-36
7.1.1-37
7.1.1-38
7.1.1-39
7.1.1-40
7.1.1-41
7.1.1-43
7.1.1-44
7.1.1-45
7.1.1-46
7.1.1-47
7.1.1-7
7.1.1-8
7.1.1-9
7.1.2-0
7.1.2-1
7.1.2-10
7.1.2-11
7.1.2-12
7.1.2-13
7.1.2-14
7.1.2-15
7.1.2-16
7.1.2-17
7.1.2-18
7.1.2-19
7.1.2-2
7.1.2-20
7.1.2-21
7.1.2-22
7.1.2-23
7.1.2-24
7.1.2-25
7.1.2-26
7.1.2-27
7.1.2-28
7.1.2-29
7.1.2-3
7.1.2-30
7.1.2-31
7.1.2-5
7.1.2-6
7.1.2-7
7.1.2-8
7.1.2-9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-109265.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "107954138934556030366045615124720062043",
                "246451224697772028852264887245421408568",
                "98678649382394745059970778298528002141",
                "67871677290562537714751173531262322699",
                "190670662892330853114375804437618312824",
                "207365027701783767708290811999699101591",
                "244226251079442192074820375790014244351",
                "219334464246599273973682402246610731421",
                "5778768589296151320847448852777425484",
                "150669833082968124652465777324350317673",
                "73374867595385464857069628075309576858",
                "321648086195343557449966952441468250998",
                "86369919782796222545968599173905726275",
                "166939773403103215053525078914391991010",
                "130981438025341170316564304655096344930",
                "313319681345728910201565990867080031025",
                "150083997180191874412252011684736703478",
                "102914293738747914175465145059576117213",
                "46491880596958011528745621525812919352",
                "122184951944827789669399517181900336399",
                "136516538117759173397263133244004843750",
                "99379906983052675778227580889469228616",
                "336544467757452338758196310587371645889",
                "220687544074002586382832040316892398600",
                "41446751137070038764779716707688362114",
                "225153391659665053794397231109470011152",
                "306451296727465239579817358422702805847",
                "149075491244459285510973472136137459022",
                "158695350727474380351051656924805555526",
                "72009013752555901515984086042490759351",
                "219370587762158533846509841994930640159",
                "95802434562145486402175352530126625976",
                "196758283079122531802254467809599122988",
                "248016665495614459178689598683678317824",
                "319650506337322620437493357204972351434",
                "133331077730805715195137423720350659866",
                "303482007663905993833892035791424209124",
                "93605937037570931747200891953667278529",
                "252362592809360539228096610864447408026",
                "339689014448797903759637867394916501672",
                "57133945214519330754260077047368077159",
                "120291212842023791493303458228971420739",
                "300355677167263797887615936647099955887",
                "321136417687641452581664631382127262131",
                "307745885978496429612744939052363545249",
                "214248106040772928349626654633512729176",
                "204327769864939731228893313184979864074",
                "176400123231344914527758611110754775482",
                "281600520999585317604090306881501878907",
                "162395823293964769914971287338872850569",
                "259002736566019061736692136870192941516",
                "270163062140231019961102950475176218915",
                "118959883683299595537065305774219572792",
                "44460554301946187299630803233442591549",
                "2761626631312338920450417167265662368",
                "293655244998520323247062746183771461102",
                "155563195601060628259370560123520978415",
                "286146788580553007759151664387768383570",
                "144349855326022734853058993990744129908",
                "78044603442128665059970382999712188155",
                "71548136336465729242162378268487680320",
                "259570155438523286217610635047946748349"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-109265-a8452bb3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/imagemagick/imagemagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7",
        "target": {
            "file": "MagickCore/profile.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "282833336904041314915525174729769648825",
            "length": 540
        },
        "id": "CVE-2026-109265-dbe670e5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/imagemagick/imagemagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7",
        "target": {
            "file": "MagickCore/profile.c",
            "function": "ReplaceXmpValue"
        }
    }
]
vanir_signatures_modified 
"2026-10-17T07:06:43Z"