# CVE-2026-109273: ImageMagick information disclosure in PostScript decoder

Source: https://junglewise.ai/threats/cve-2026-109273-imagemagick-before-6-9-13-57-and-7-x-before-7-1-2-32-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109273 · Severity: medium · CVSS 5.3 · Published 2026-10-12

ImageMagick is an image processing library used by many applications to convert and manipulate images. A crafted PostScript file can trigger ImageMagick to allocate a buffer one byte larger than the data it contains, exposing one uninitialized byte of memory. This could leak sensitive information such as passwords, keys, or other secrets in memory at the time of processing.

Technologies: [ImageMagick](https://junglewise.ai/threats/technologies/imagemagick). Vendors: [ImageMagick](https://junglewise.ai/threats/vendors/imagemagick).

## Quick answers

**Is CVE-2026-109273 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109273 being exploited in the wild.

**How severe is CVE-2026-109273?** Medium severity, with a CVSS score of 5.3, published 12 October 2026.

**Which products and versions are affected?** ImageMagick 6.x before 6.9.13-57, 7.x before 7.1.2-32.

**Is there a fix for CVE-2026-109273?** Yes: fixed in ImageMagick 6.9.13-57, 7.1.2-32. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109273 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-109273?** Check whether you run ImageMagick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ImageMagick 6.9.13-57, 7.1.2-32

## Technical details

The PostScript decoder in ImageMagick's ps.c allocates a buffer for ICC profile data that is one byte longer than the actual decoded data, leaving uninitialized memory exposed. An attacker can supply a crafted PostScript file to trigger this condition and read the uninitialized byte via information disclosure. The vulnerability requires network access and can be triggered without authentication or user interaction, though complexity is high.

## Affected products

- ImageMagick ImageMagick 6.x before 6.9.13-57, 7.x before 7.1.2-32

## Timeline

- 2026-09-27: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/ImageMagick/ImageMagick/commit/5a5c2e51948fcc5d85b8d832938e2c1b4db4a699](https://github.com/ImageMagick/ImageMagick/commit/5a5c2e51948fcc5d85b8d832938e2c1b4db4a699)
- [https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5j8x-vq8c-vrp9](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5j8x-vq8c-vrp9)

## Related threats

- [ImageMagick infinite loop in SVG decoder](https://junglewise.ai/threats/cve-2026-123273-imagemagick-before-7-1-2-35-and-6-9-13-60-contains-an-infinite)
- [ImageMagick memory leak in XMP profile handling](https://junglewise.ai/threats/cve-2026-116155-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in XML parsing depth limit](https://junglewise.ai/threats/cve-2026-116154-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in MAT decoder](https://junglewise.ai/threats/cve-2026-116152-imagemagick-before-7-1-2-33-contains-a-memory-leak-vulnerability)
- [ImageMagick stack buffer overflow in bzip2 decompression](https://junglewise.ai/threats/cve-2026-116149-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)