CVE-2026-102635

MediumCVSS 5.3/10Last modified Oct 15, 2026

Description

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-908

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Oct 15, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1026396.5MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic t CVE-2026-102643.5A vulnerability was determined in lharries whatsapp-mcp 0.0.1. Affected by this vulnerability is the function SendMessageRequest of the file CVE-2026-102656.3A vulnerability was identified in itsourcecode Content Management System 1.0. Affected by this issue is some unknown functionality of the fi CVE-2026-1026634.3OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware CVE-2026-1026666.5The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST AP CVE-2026-1026678.3Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permi CVE-2026-1026685.3The Joyland AI app accepts any TLS certificates from any server without validation.CVE-2026-1026695.3Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages.CVE-2026-102673.3A security flaw has been discovered in janet-lang janet up to 1.41.0. This affects the function doframe of the file src/core/debug.c. Perfor CVE-2026-1026704.3Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.CVE-2026-1026715.3The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.CVE-2026-1026726.7Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.