{"id":"CVE-2026-109265","summary":"ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile","details":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.","aliases":["GHSA-jph3-37cg-79wg"],"modified":"2026-10-13T02:46:58.102333763Z","published":"2026-10-12T16:04:33.986Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109265.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109265.json"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7"},{"type":"ADVISORY","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/imagemagick/imagemagick","events":[{"introduced":"21d049b305ff00c77e168bad1085abb73b7f2201"},{"fixed":"ad98b244c995d2e3051757fa3b7855f45b550d24"}],"database_specific":{"extracted_events":[{"introduced":"7.1.1-7"},{"fixed":"7.1.2-32"}],"source":"AFFECTED_FIELD"}}],"versions":["7.1.2-31","7.1.2-30","7.1.2-29","7.1.2-28","7.1.2-27","7.1.2-26","7.1.2-25","7.1.2-24","7.1.2-23","7.1.2-22","7.1.2-21","7.1.2-20","7.1.2-19","7.1.2-18","7.1.2-17","7.1.2-16","7.1.2-15","7.1.2-14","7.1.2-13","7.1.2-12","7.1.2-11","7.1.2-10","7.1.2-9","7.1.2-8","7.1.2-7","7.1.2-6","7.1.2-5","7.1.2-3","7.1.2-2","7.1.2-1","7.1.2-0","7.1.1-47","7.1.1-46","7.1.1-45","7.1.1-44","7.1.1-43","7.1.1-41","7.1.1-40","7.1.1-39","7.1.1-38","7.1.1-37","7.1.1-36","7.1.1-35","7.1.1-34","7.1.1-33","7.1.1-32","7.1.1-31","7.1.1-30","7.1.1-29","7.1.1-28","7.1.1-27","7.1.1-26","7.1.1-25","7.1.1-24","7.1.1-23","7.1.1-22","7.1.1-21","7.1.1-20","7.1.1-19","7.1.1-18","7.1.1-17","7.1.1-16","7.1.1-15","7.1.1-14","7.1.1-13","7.1.1-12","7.1.1-11","7.1.1-10","7.1.1-9","7.1.1-8","7.1.1-7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109265.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}