CVE-2026-107209 ImageMagick CVE debrief

Who should care

ImageMagick administrators, developers, and users who utilize ImageMagick built without Cairo support should assess exposure and verify remediation. Defenders should prioritize verifying ImageMagick installations, especially those built without Cairo support, and ensure they are updated to versions 7.1.2-30 or 6.9.13-55. ImageMagick administrators should assess exposure and verify remediation.

Why it matters

Defenders should prioritize verifying ImageMagick installations, especially those built without Cairo support, and ensure they are updated to versions 7.1.2-30 or 6.9.13-55. ImageMagick administrators should assess exposure and verify remediation.

• Verify ImageMagick installations and ensure they are updated to versions 7.1.2-30 or 6.9.13-55 to prevent potential crashes.
• Assess exposure, especially for ImageMagick built without Cairo support, to determine if the vulnerability affects your deployment.
• Monitor for potential crashes or issues after updating ImageMagick to ensure the fix is effective.

Technical summary

A use-after-free issue in the RSVG decoder of ImageMagick, when built without Cairo support, can cause a crash when processing a crafted RSVG image that reaches a resource limit. This issue is fixed in versions 7.1.2-30 and 6.9.13-55. ImageMagick administrators should assess exposure and verify remediation. The vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. Defenders should prioritize verifying ImageMagick installations, especially those built without Cairo support, and ensure they are updated to versions 7.1.2-30 or 6.9.13-55.

Defensive priority

Defenders should prioritize verifying ImageMagick installations, especially those built without Cairo support, and ensure they are updated to versions 7.1.2-30 or 6.9.13-55. ImageMagick administrators should assess exposure and verify remediation.

Recommended defensive actions

• Verify ImageMagick installations and ensure they are updated to versions 7.1.2-30 or 6.9.13-55.
• Assess exposure, especially for ImageMagick built without Cairo support.
• Verify remediation and monitor for potential crashes or issues.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. The source item and supplemental sources offer additional context. Defenders should verify ImageMagick installations, especially those built without Cairo support, and ensure they are updated to versions 7.1.2-30 or 6.9.13-55. The vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. ImageMagick administrators should assess exposure and verify remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.