CVE-2026-105402 ImageMagick CVE debrief

Who should care

Defenders responsible for ImageMagick installations, particularly those using versions before 7.1.2-31, should assess exposure and prioritize verification and remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify ImageMagick versions, review input to prevent crafted XMP profiles, and monitor ImageMagick processing for potential denial of service attacks.

Why it matters

Defenders should prioritize verifying ImageMagick versions and updating to 7.1.2-31 or later to prevent potential denial of service attacks. ImageMagick installations, particularly those using versions before 7.1.2-31, are at risk and should assess exposure. The vulnerability allows attackers to disrupt processing by supplying a crafted XMP profile, potentially impacting dependent applications and workflows.

• Potential disruption of image processing services
• Possible impact on dependent applications and workflows
• Need for verification of ImageMagick versions and updates
• Potential for denial of service attacks

Technical summary

ImageMagick before 7.1.2-31 contains a denial of service vulnerability that allows attackers to disrupt processing by supplying a crafted XMP profile. Attackers can embed a malicious XMP profile that triggers a failure when determining the numerator and denominator, crashing or hanging image processing. The vulnerability is caused by a lack of proper validation of the XMP profile, which can lead to a denial of service attack. Defenders should prioritize verifying ImageMagick versions and updating to 7.1.2-31 or later to prevent potential denial of service attacks.

Defensive priority

Defenders should prioritize verifying ImageMagick versions and updating to 7.1.2-31 or later to prevent potential denial of service attacks.

Recommended defensive actions

• Verify ImageMagick versions and update to 7.1.2-31 or later
• Review and restrict input to ImageMagick to prevent crafted XMP profiles
• Monitor ImageMagick processing for potential denial of service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide information on the denial of service vulnerability in ImageMagick before 7.1.2-31. The vulnerability is triggered by a crafted XMP profile that causes a failure when determining the numerator and denominator. Defenders should verify ImageMagick versions and review input to prevent crafted XMP profiles. The source item and CVE record provide details on the vulnerability, but additional verification is necessary to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.