# CVE-2026-109266: ImageMagick XML injection in CIP encoder

Source: https://junglewise.ai/threats/cve-2026-109266-imagemagick-before-6-9-13-57-and-7-x-before-7-1-2-32-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109266 · Severity: medium · CVSS 5.3 · Published 2026-10-12

ImageMagick is an image processing library used to convert between different image formats. The CIP encoder, which generates Cisco IP Phone XML output, fails to properly escape special characters in image metadata, allowing attackers to inject arbitrary XML tags. An attacker who supplies a crafted image file can embed malicious XML that gets written into the output, potentially leading to data leakage or code injection depending on how the XML is processed.

Technologies: [ImageMagick](https://junglewise.ai/threats/technologies/imagemagick). Vendors: [ImageMagick](https://junglewise.ai/threats/vendors/imagemagick).

## Quick answers

**Is CVE-2026-109266 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109266 being exploited in the wild.

**How severe is CVE-2026-109266?** Medium severity, with a CVSS score of 5.3, published 12 October 2026.

**Which products and versions are affected?** ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32.

**Is there a fix for CVE-2026-109266?** Yes: fixed in ImageMagick 6.9.13-57, 7.1.2-32. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109266 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-109266?** Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ImageMagick 6.9.13-57, 7.1.2-32

## Technical details

The CIP encoder in ImageMagick does not properly escape input-derived data (such as image titles) when generating Cisco IP Phone XML output, resulting in an XML injection vulnerability (CWE-91). An attacker can exploit this by providing a crafted image file where metadata contains XML special characters or markup; when converted to CIP format, the unescaped input is embedded into the XML, allowing injection of arbitrary elements. The vulnerability requires local access and user interaction to convert the file, but can result in code injection or information disclosure.

## Affected products

- ImageMagick ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32

## Timeline

- 2026-09-27: disclosed: GitHub security advisory GHSA-3429-f84m-8qhw published
- 2026-10-12: advisory: NVD published CVE-2026-109266

## References

- [https://github.com/ImageMagick/ImageMagick/commit/45bb7328b36c163234f5ccb7f1d494b7c4c8c775](https://github.com/ImageMagick/ImageMagick/commit/45bb7328b36c163234f5ccb7f1d494b7c4c8c775)
- [https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3429-f84m-8qhw](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3429-f84m-8qhw)

## Related threats

- [ImageMagick infinite loop in SVG decoder](https://junglewise.ai/threats/cve-2026-123273-imagemagick-before-7-1-2-35-and-6-9-13-60-contains-an-infinite)
- [ImageMagick memory leak in XMP profile handling](https://junglewise.ai/threats/cve-2026-116155-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in XML parsing depth limit](https://junglewise.ai/threats/cve-2026-116154-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in MAT decoder](https://junglewise.ai/threats/cve-2026-116152-imagemagick-before-7-1-2-33-contains-a-memory-leak-vulnerability)
- [ImageMagick stack buffer overflow in bzip2 decompression](https://junglewise.ai/threats/cve-2026-116149-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)