Is CVE-2026-109266 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109266 being exploited in the wild.

How severe is CVE-2026-109266?

Medium severity, with a CVSS score of 5.3, published 12 October 2026.

Which products and versions are affected?

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32.

Is there a fix for CVE-2026-109266?

Yes: fixed in ImageMagick 6.9.13-57, 7.1.2-32. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109266 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-109266?

Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109266: ImageMagick XML injection in CIP encoder

CVE-2026-109266 · Severity: medium · CVSS 5.3 · Published 2026-10-12

ImageMagick is an image processing library used to convert between different image formats. The CIP encoder, which generates Cisco IP Phone XML output, fails to properly escape special characters in image metadata, allowing attackers to inject arbitrary XML tags. An attacker who supplies a crafted image file can embed malicious XML that gets written into the output, potentially leading to data leakage or code injection depending on how the XML is processed.

Technologies: ImageMagick. Vendors: ImageMagick.

Quick answers

Is CVE-2026-109266 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109266 being exploited in the wild.
How severe is CVE-2026-109266?: Medium severity, with a CVSS score of 5.3, published 12 October 2026.
Which products and versions are affected?: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32.
Is there a fix for CVE-2026-109266?: Yes: fixed in ImageMagick 6.9.13-57, 7.1.2-32. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109266 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-109266?: Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ImageMagick 6.9.13-57, 7.1.2-32

Technical details

The CIP encoder in ImageMagick does not properly escape input-derived data (such as image titles) when generating Cisco IP Phone XML output, resulting in an XML injection vulnerability (CWE-91). An attacker can exploit this by providing a crafted image file where metadata contains XML special characters or markup; when converted to CIP format, the unescaped input is embedded into the XML, allowing injection of arbitrary elements. The vulnerability requires local access and user interaction to convert the file, but can result in code injection or information disclosure.

Affected products

ImageMagick ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32

Timeline

2026-09-27: disclosed: GitHub security advisory GHSA-3429-f84m-8qhw published
2026-10-12: advisory: NVD published CVE-2026-109266

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.