Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M
CVE-2026-107208ImageMagick: Denial of service with crafted XMP profile
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in ImageMagick from ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u14 | DEBIAN-CVE-2026-107208 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u13 | DEBIAN-CVE-2026-107208 |
| Debian:14 | imagemagick | 8:7.1.2.31+dfsg1-1 | DEBIAN-CVE-2026-107208 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | < 6.9.13-55>= 7.0.0, < 7.1.2-30 |
Weakness: CWE-400, CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-27m9-54jx-fgvq x_refsource_CONFIRM
- https://github.com/ImageMagick/ImageMagick/commit/907b74817836b4f88e7453f0e95c849a1c5311aa x_refsource_MISC
- https://github.com/ImageMagick/ImageMagick6/commit/6ba345f88a14fcce35c723c231914ae054c4281a x_refsource_MISC
- https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30 x_refsource_MISC
- https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55 x_refsource_MISC