CVE-2026-109276CWE-459

CVE-2026-109276

Medium · published October 12, 2026

CVSS v3.1

5.3

EPSS

Percentile

31.3

In the wild

Unconfirmed

What it is

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0: 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00384 · 31.3th percentile
Weakness: CWE-459 · Incomplete Cleanup
Published: 2026-10-12T21:17Z

References (4)

https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a · [email protected]https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r · [email protected]https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b · [email protected]https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder · [email protected]

EPSS history

Timeline

14 OCT 03:27Z
EPSS moved — → 0%
epss
12 OCT 16:04Z
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
cvelistv5
12 OCT 16:04Z
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
cvelistv5