CVE-2026-109276
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.
| CWE | CWE-459 |
| Vendor | imagemagick |
| Product | imagemagick |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for imagemagick imagemagick
Be the first to know when new medium vulnerabilities affecting imagemagick imagemagick are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
ImageMagick / ImageMagick
7.0.0-0 < 7.1.2-32
ImageMagick / ImageMagick
0 < 6.9.13-57
References
github.com: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r github.com: https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a github.com: https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b vulncheck.com: https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder
Credits
🔍 Yanhaoxi