Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-109268

Fixed in a distro release EPSS <1%CVSS 3.7

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process.

Published 2026-10-12 · CVE record · OSV

Products: imagemagick

Distro releases

ReleasePackageFixed in
Debian 12imagemagickno fix
Debian 13imagemagickno fix
Debian 14imagemagickno fix
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7ImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server 15 SP4-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server 15 SP5-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server 15 SP6-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4ImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5ImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6ImageMagick7.1.0.9-150400.6.122.1
Ubuntu 26.10imagemagickno fix
Ubuntu Pro 14.04 LTSimagemagickno fix
Ubuntu Pro 16.04 LTSimagemagickno fix
Ubuntu Pro 18.04 LTSimagemagickno fix
Ubuntu Pro 20.04 LTSimagemagickno fix
Ubuntu Pro 22.04 LTSimagemagickno fix
Ubuntu Pro 24.04 LTSimagemagickno fix
Ubuntu Pro 26.04 LTSimagemagickno fix
openSUSE TumbleweedImageMagick7.1.2.34-1.1