CVE-2026-105402 in ImageMagick
Summary
by MITRE • 10/08/2026
ImageMagick before 7.1.2-31 contains a denial of service vulnerability that allows attackers to disrupt processing by supplying a crafted XMP profile. Attackers can embed a malicious XMP profile that triggers a failure when determining the numerator and denominator, crashing or hanging image processing.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The identified security flaw resides within ImageMagick versions prior to 7.1.2-31, specifically affecting the handling of Extensible Metadata Platform profiles embedded within image files. This vulnerability is classified as a denial of service condition that arises from improper validation and arithmetic processing during the parsing phase of XMP metadata extraction. The core technical issue involves a failure in determining the numerator and denominator values associated with rational numbers or fractions contained within the crafted XML structure. When an attacker supplies a specially constructed XMP profile, the software attempts to parse these numerical components without adequate bounds checking or error handling for malformed input sequences. This lack of robust validation leads to undefined behavior during arithmetic operations, which can result in integer overflow, division by zero errors, or infinite loops depending on the specific configuration and internal state of the parser at the time of execution.
From a technical perspective, this vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-369 Divide By Zero if the denominator is derived from untrusted input without verification. The attack vector requires an attacker to provide a maliciously crafted image file containing the hostile XMP profile. This can be achieved through various means such as uploading the file via a web application, sending it as an email attachment processed by a mail server with ImageMagick integration, or simply tricking a user into opening the file in a vulnerable viewer that utilizes the library for rendering previews. The operational impact is significant because image processing libraries are often used in high-throughput environments where availability is critical. A successful exploit can cause the application hosting ImageMagick to crash unexpectedly or hang indefinitely, consuming system resources and preventing legitimate users from accessing services. In server-side applications, this could lead to resource exhaustion if multiple requests trigger the vulnerability simultaneously, effectively creating a distributed denial of service scenario against the backend infrastructure.
The severity of this issue is further contextualized by its potential inclusion in attack frameworks such as MITRE ATT&CK under techniques related to Resource Hijacking or Service Availability disruption. While it does not directly allow for remote code execution or data exfiltration, the ability to disrupt processing pipelines makes it a valuable tool for attackers seeking to degrade service quality or cause operational downtime. Mitigation strategies primarily involve upgrading ImageMagick to version 7.1.2-31 or later, where these parsing logic errors have been corrected with proper input sanitization and exception handling mechanisms. For environments that cannot immediately upgrade due to compatibility constraints, implementing a web application firewall rule set capable of detecting anomalous XML structures in uploaded files can provide an additional layer of defense. Additionally, configuring the ImageMagick policy.xml file to restrict or disable XMP profile processing for untrusted inputs is recommended as a temporary countermeasure until patching can be fully implemented across all affected systems.