CVE-2026-109279

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32

Description Insufficient synchronization occurs when the security policy is accessed. Simultaneous reads and writes of the policy by multiple threads trigger a race condition, which is a situation where the timing or order of events affects the correctness of the code, leading to a heap buffer over-write. An attacker capable of inducing concurrent security policy access can crash the application, resulting in a denial of service.

Recommendations Update ImageMagick to version 6.9.13-57 or later. Update ImageMagick to version 7.1.2-32 or later.