ImageMagick before 7.1.2-30 Denial of Service via Crafted XMP Profile
ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a denial of service vulnerability in its handling of XMP profiles, where a crafted profile terminates the process instead of raising an exception. Attackers can supply images with malicious XMP profiles to crash applications that process them using ImageMagick.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-107208US | — | — | ||
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit th… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105825.jsonADVISORY
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-27m9-54jx-fgvqADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-105825ADVISORY
- https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-denial-of-service-via-crafted-xmp-profileADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan