CVE-2026-109279: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-109279 is a race condition vulnerability in ImageMagick that causes a heap buffer over-write when multiple threads simultaneously read and write the security policy, resulting in a denial of service (application crash). It affects ImageMagick versions before 6.9.13-57 (6.x branch) and 7.x versions before 7.1.2-32. The vulnerability was published on October 12, 2026, and was reported by researcher Yanhaoxi. It carries a CVSS v3.1 base score of 2.5 (Low) and a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper synchronization (CWE-362: Race Condition) in the SetMagickSecurityPolicy() function within MagickCore/policy.c (and magick/policy.c for the 6.x branch), where the LoadPolicyCache() call was not protected by a semaphore lock. When multiple threads concurrently read and write the security policy, a timing window allows one thread to corrupt heap memory being accessed by another, resulting in an out-of-bounds write (CWE-787). The fix adds LockSemaphoreInfo(policy_semaphore) and UnlockSemaphoreInfo(policy_semaphore) calls around the LoadPolicyCache() invocation to serialize access. Exploitation requires a local attacker with low privileges who can induce concurrent security policy access, making this a high-complexity attack (GitHub Advisory, IM7 Commit, IM6 Commit).

Successful exploitation causes ImageMagick to crash, resulting in a denial of service. There is no impact on confidentiality or integrity — only availability is affected, and only at a low severity level. In environments where ImageMagick is used as a shared service or in multi-threaded image processing pipelines, repeated exploitation could cause persistent service disruption (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, and the ability to trigger concurrent security policy access — conditions that significantly limit the practical attack surface (GitHub Advisory).

Upgrade ImageMagick to version 6.9.13-57 or later (6.x branch) or 7.1.2-32 or later (7.x branch), which add proper semaphore locking around security policy cache updates. As a workaround, restrict ImageMagick functionality to trusted users only and avoid exposing multi-threaded policy update paths to untrusted input. Monitor for abnormal application crashes that may indicate exploitation attempts (GitHub Advisory, IM7 Commit, IM6 Commit).