CVE-2026-102635CWE-908

CVE-2026-102635

Low · published September 29, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00323 · 24.1th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2026-09-29T21:17Z
Affected products (2)
ProductVersionsFixed in
imagemagick/imagemagick< 6.9.13-576.9.13-57
imagemagick/imagemagick≥ 7.0.0-0, < 7.1.2-327.1.2-32
References (6)
https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/coders/gif.c#L1168-L1196 · [email protected]https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4 · [email protected]https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc · [email protected]https://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5 · [email protected]https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-uninitialized-heap-memory-disclosure-in-gif-decoder · [email protected]https://github.com/ImageMagick/ImageMagick · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 16:04Z
    ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder
    cvelistv5