2549773 – (CVE-2026-109259) CVE-2026-109259 ImageMagick: ImageMagick: Information disclosure via crafted TGA image

Bug 2549773 (CVE-2026-109259) - CVE-2026-109259 ImageMagick: ImageMagick: Information disclosure via crafted TGA image

Summary: CVE-2026-109259 ImageMagick: ImageMagick: Information disclosure via crafted ...

Keywords:
Status:	NEW
Alias:	CVE-2026-109259
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security DevOps Team
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2550262
Blocks:
TreeView+	depends on / blocked

Reported:	2026-10-12 16:46 UTC by OSIDB Bzimport
Modified:	2026-10-13 08:04 UTC (History)
CC List:	2 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Description OSIDB Bzimport 2026-10-12 16:46:11 UTC

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.

Note You need to log in before you can comment on or make changes to this bug.