CVE-2026-109282

LowCVSS 2.5/10Last modified Nov 3, 2026

Description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service.

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-843

Affected software

VendorProductVersions
ImageMagickImageMagick>= 7.0.0-0, < 7.1.2-32
ImageMagickImageMagick< 6.9.13-57

References

Timeline

Published
Oct 12, 2026
Last modified
Nov 3, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1092835.4Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only froCVE-2026-1092844.3Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats inCVE-2026-1092855.0Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base CVE-2026-1092868.1Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steaCVE-2026-1092874.3Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied dirCVE-2026-1092886.4Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URCVE-2026-1092896.3Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminaCVE-2026-109298.3Heap buffer overflow in ANGLE in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer CVE-2026-1092908.7Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated usCVE-2026-1092917.3Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victCVE-2026-1092926.8Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user sessionCVE-2026-1092936.5Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool ex
CVE-2026-109282: Low severity, CVSS 2.5 | Vulnix