{"id":"CVE-2026-109265","summary":"ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile","details":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.","aliases":["GHSA-jph3-37cg-79wg"],"modified":"2026-10-19T17:27:19.991814892Z","published":"2026-10-12T16:04:33.986Z","related":["openSUSE-SU-2026:12170-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109265.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-125"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109265.json"},{"type":"ADVISORY","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/imagemagick/imagemagick","events":[{"introduced":"21d049b305ff00c77e168bad1085abb73b7f2201"},{"fixed":"ad98b244c995d2e3051757fa3b7855f45b550d24"},{"fixed":"7605c7619da77a5ff1ccf4ec159f3ec782c6bda7"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"7.1.1-7"},{"fixed":"7.1.2-32"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"7605c7619da77a5ff1ccf4ec159f3ec782c6bda7"}]}]}}],"versions":["7.1.2-31","7.1.2-30","7.1.2-29","7.1.2-28","7.1.2-27","7.1.2-26","7.1.2-25","7.1.2-24","7.1.2-23","7.1.2-22","7.1.2-21","7.1.2-20","7.1.2-19","7.1.2-18","7.1.2-17","7.1.2-16","7.1.2-15","7.1.2-14","7.1.2-13","7.1.2-12","7.1.2-11","7.1.2-10","7.1.2-9","7.1.2-8","7.1.2-7","7.1.2-6","7.1.2-5","7.1.2-3","7.1.2-2","7.1.2-1","7.1.2-0","7.1.1-47","7.1.1-46","7.1.1-45","7.1.1-44","7.1.1-43","7.1.1-41","7.1.1-40","7.1.1-39","7.1.1-38","7.1.1-37","7.1.1-36","7.1.1-35","7.1.1-34","7.1.1-33","7.1.1-32","7.1.1-31","7.1.1-30","7.1.1-29","7.1.1-28","7.1.1-27","7.1.1-26","7.1.1-25","7.1.1-24","7.1.1-23","7.1.1-22","7.1.1-21","7.1.1-20","7.1.1-19","7.1.1-18","7.1.1-17","7.1.1-16","7.1.1-15","7.1.1-14","7.1.1-13","7.1.1-12","7.1.1-11","7.1.1-10","7.1.1-9","7.1.1-8","7.1.1-7"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-109265.json","vanir_signatures":[{"source":"https://github.com/imagemagick/imagemagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","target":{"file":"MagickCore/profile.c"},"deprecated":false,"digest":{"line_hashes":["107954138934556030366045615124720062043","246451224697772028852264887245421408568","98678649382394745059970778298528002141","67871677290562537714751173531262322699","190670662892330853114375804437618312824","207365027701783767708290811999699101591","244226251079442192074820375790014244351","219334464246599273973682402246610731421","5778768589296151320847448852777425484","150669833082968124652465777324350317673","73374867595385464857069628075309576858","321648086195343557449966952441468250998","86369919782796222545968599173905726275","166939773403103215053525078914391991010","130981438025341170316564304655096344930","313319681345728910201565990867080031025","150083997180191874412252011684736703478","102914293738747914175465145059576117213","46491880596958011528745621525812919352","122184951944827789669399517181900336399","136516538117759173397263133244004843750","99379906983052675778227580889469228616","336544467757452338758196310587371645889","220687544074002586382832040316892398600","41446751137070038764779716707688362114","225153391659665053794397231109470011152","306451296727465239579817358422702805847","149075491244459285510973472136137459022","158695350727474380351051656924805555526","72009013752555901515984086042490759351","219370587762158533846509841994930640159","95802434562145486402175352530126625976","196758283079122531802254467809599122988","248016665495614459178689598683678317824","319650506337322620437493357204972351434","133331077730805715195137423720350659866","303482007663905993833892035791424209124","93605937037570931747200891953667278529","252362592809360539228096610864447408026","339689014448797903759637867394916501672","57133945214519330754260077047368077159","120291212842023791493303458228971420739","300355677167263797887615936647099955887","321136417687641452581664631382127262131","307745885978496429612744939052363545249","214248106040772928349626654633512729176","204327769864939731228893313184979864074","176400123231344914527758611110754775482","281600520999585317604090306881501878907","162395823293964769914971287338872850569","259002736566019061736692136870192941516","270163062140231019961102950475176218915","118959883683299595537065305774219572792","44460554301946187299630803233442591549","2761626631312338920450417167265662368","293655244998520323247062746183771461102","155563195601060628259370560123520978415","286146788580553007759151664387768383570","144349855326022734853058993990744129908","78044603442128665059970382999712188155","71548136336465729242162378268487680320","259570155438523286217610635047946748349"],"threshold":0.9},"id":"CVE-2026-109265-a8452bb3","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","target":{"function":"ReplaceXmpValue","file":"MagickCore/profile.c"},"deprecated":false,"digest":{"function_hash":"282833336904041314915525174729769648825","length":540},"id":"CVE-2026-109265-dbe670e5"}],"vanir_signatures_modified":"2026-10-17T07:06:43Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}