# CVE-2026-109265: ImageMagick heap buffer over-read in XMP profile parsing

Source: https://junglewise.ai/threats/cve-2026-109265-imagemagick-7-1-1-7-before-7-1-2-32-contains-a-heap-buffer-over  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109265 · Severity: medium · CVSS 5.3 · Published 2026-10-12

ImageMagick is an image processing library used by many applications to manipulate and convert image files. A flaw in how it parses XMP metadata in images can cause it to read memory beyond allocated boundaries, leading to application crashes and potential data leakage. An attacker can exploit this by supplying a specially crafted image file.

Technologies: [ImageMagick](https://junglewise.ai/threats/technologies/imagemagick). Vendors: [ImageMagick](https://junglewise.ai/threats/vendors/imagemagick).

## Quick answers

**Is CVE-2026-109265 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109265 being exploited in the wild.

**How severe is CVE-2026-109265?** Medium severity, with a CVSS score of 5.3, published 12 October 2026.

**Which products and versions are affected?** ImageMagick before 7.1.2-32.

**Is there a fix for CVE-2026-109265?** Yes: fixed in 7.1.2-32. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109265 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109265?** Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.1.2-32

## Technical details

A heap buffer over-read vulnerability exists in ImageMagick's XMP profile parsing due to incorrect string termination, allowing reads beyond allocated memory. The vulnerability is triggered when processing a crafted image with a malformed XMP profile; it requires network access but high attack complexity. The flaw can crash the application and potentially leak sensitive data from memory.

## Affected products

- ImageMagick ImageMagick before 7.1.2-32

## Timeline

- 2026-09-27: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7](https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7)
- [https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg)

## Related threats

- [ImageMagick infinite loop in SVG decoder](https://junglewise.ai/threats/cve-2026-123273-imagemagick-before-7-1-2-35-and-6-9-13-60-contains-an-infinite)
- [ImageMagick memory leak in XMP profile handling](https://junglewise.ai/threats/cve-2026-116155-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in XML parsing depth limit](https://junglewise.ai/threats/cve-2026-116154-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in MAT decoder](https://junglewise.ai/threats/cve-2026-116152-imagemagick-before-7-1-2-33-contains-a-memory-leak-vulnerability)
- [ImageMagick stack buffer overflow in bzip2 decompression](https://junglewise.ai/threats/cve-2026-116149-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)