Medium severity · published Oct 12, 2026
CVE-2026-109276
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
ImageMagick · ImageMagick
7.0.0-0 before 7.1.2-32; before 6.9.13-57 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109276
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109276
vendor-advisory
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r
patch
https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a
patch
https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b
third-party-advisory
https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder
More from ImageMagick
8.4
CVE-2016-3714
ImageMagick Improper Input Validation Vulnerability
5.5
CVE-2016-3715
ImageMagick Arbitrary File Deletion Vulnerability
5.5
CVE-2016-3718
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
9.8
CVE-2026-25986
ImageMagick has a heap buffer overflow in YUV 4:2:2 decoder
9.8
CVE-2026-25983
ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"