CVE-2026-109279CWE-362

CVE-2026-109279

Low · published October 12, 2026

CVSS v3.1
2.5
EPSS
0%
Percentile
0.3
In the wild
Unconfirmed
What it is

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. An attacker able to induce concurrent security policy access can crash the application, causing a denial of service.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
2.0 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00087 · 0.3th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-10-12T21:17Z
References (4)
https://github.com/ImageMagick/ImageMagick/commit/12db6f04e895deae4537ead10c771a244607794a · [email protected]https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8x3v-wr32-qqh4 · [email protected]https://github.com/ImageMagick/ImageMagick6/commit/9ddc71abea5cbe7d18164fa0f0077a105cab514f · [email protected]https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-heap-buffer-overflow-via-concurrent-security-policy-access · [email protected]
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 12 OCT 16:04Z
    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access
    cvelistv5
  • 12 OCT 16:04Z
    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access
    cvelistv5