CVE-2026-109282: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-109282 is a type confusion (CWE-843) vulnerability in ImageMagick's INFO, JSON, and YAML encoders that allows a local attacker to crash the process and cause denial of service. It affects ImageMagick before version 6.9.13-57 (6.x branch) and 7.x before 7.1.2-32. The flaw was reported by researcher Yanhaoxi and disclosed via a GitHub Security Advisory on September 27, 2026, with the CVE published on October 12, 2026. It carries a CVSS v3.1 base score of 2.5 (Low) and a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a type confusion flaw (CWE-843) in the GetBlobFileHandle() function within MagickCore/blob.c. When writing an image using the INFO, JSON, or YAML encoders in a compressed format (e.g., ZIP or BZIP2 streams), the internal method GetBlobFileHandle() previously returned the raw file_info.file pointer regardless of the underlying blob type, meaning it could return a non-FILE* pointer when the blob was backed by a ZipStream, BZipStream, BlobStream, or similar non-file-backed stream. The callers in coders/info.c, coders/json.c, and coders/yaml.c then passed this invalid pointer to functions expecting a valid FILE*, triggering a SIGABRT or SIGSEGV. The fix adds a type-check switch statement in GetBlobFileHandle() to return NULL for non-file-backed blob types, and the encoder coders now check for a NULL return and raise a CoderDoesNotSupportThisStreamType error instead of proceeding (GitHub Advisory, ImageMagick Commit, ImageMagick6 Commit).

Successful exploitation results in a process crash (SIGABRT or SIGSEGV), causing a denial of service to any application or pipeline relying on ImageMagick for image processing. There is no impact on confidentiality or integrity — only availability is affected, and only at a low level given the local attack vector and high attack complexity. The scope is limited to the ImageMagick process itself, with no evidence of lateral movement potential or data exposure risk (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting negligible exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and high attack complexity (the attacker must be able to trigger an image write operation using a compressed format with the affected encoders) (GitHub Advisory, Red Hat Bugzilla).

Upgrade ImageMagick to version 6.9.13-57 or later (6.x branch) or 7.1.2-32 or later (7.x branch), which contain the fix in GetBlobFileHandle() and the affected encoder coders. If immediate patching is not possible, restrict local system access to trusted users only, and avoid processing untrusted image files with the INFO, JSON, or YAML encoders in compressed output formats. Disabling or restricting use of these specific encoders in ImageMagick's policy configuration (policy.xml) can also reduce exposure (GitHub Advisory, ImageMagick Commit, ImageMagick6 Commit).

The vulnerability was reported by researcher Yanhaoxi and addressed by ImageMagick maintainer Cristy via commits to both the ImageMagick 7.x and ImageMagick6 repositories. Red Hat tracked the issue as low severity in their Bugzilla system. No significant broader media coverage or notable community commentary beyond the standard advisory and patch process has been observed (GitHub Advisory, Red Hat Bugzilla).