CVE-2026-102635: medium-severity vulnerability in ImageMagick
ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.3%
exploitation probability
0.3%top 77% of all CVEs
observed exploitation
nono source reports it
ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
ImageMagick · ImageMagickRelated CVEs — ImageMagick
In the same product, most dangerous first.
CVE-2025-55298HIGHImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code executionEPSS 4.5%CVE-2016-7523—CVE-2016-7523EPSS 2.7%CVE-2016-7524—CVE-2016-7524EPSS 2.2%CVE-2026-46522HIGHImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustionEPSS 1.9%CVE-2026-56379CRITICALImageMagick - Command Injection via SVG DecoderEPSS 1.6%CVE-2019-10131MEDIUMCVE-2019-10131EPSS 1.3%
References
https://github.com/ImageMagick/ImageMagickhttps://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/coders/gif.c#L1168-L1196https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfchttps://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-uninitialized-heap-memory-disclosure-in-gif-decoder