CVE-2026-102635: ImageMagick

Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days.

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.

Affected products

• ImageMagick ImageMagick: from 7.0.0-0, before 7.1.2-32 (fixed in 7.1.2-32); before 6.9.13-57 (fixed in 6.9.13-57)

Published 2026-09-29. Last modified 2026-09-30.