CVE-2026-107210 in ImageMagick
Summary
by MITRE • 10/07/2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
ImageMagick serves as a foundational toolset for digital image processing across numerous software ecosystems, enabling the creation, editing, conversion, and manipulation of raster images. The vulnerability identified in versions prior to 7.1.2-30 and 6.9.13-55 resides within the MAT decoder component, which is responsible for handling MATLAB data files. This specific flaw allows an attacker to bypass configured security policies by exploiting how temporary files are managed during the decoding process. When a crafted highly compressed MAT image is processed, the internal logic fails to correctly account for resource limits before expanding the file content into temporary storage locations on the disk.
The core technical deficiency lies in the failure of the decoder to enforce the maximum-memory or max-disk-space security policies defined in ImageMagick's configuration files during the decompression phase. Typically, these policies are designed to prevent denial-of-service attacks by limiting the resources a single image processing operation can consume. However, because the temporary file creation occurs before the final size validation takes effect against the compressed input metrics, an attacker can supply a small but highly compressible MAT file that expands into a massive amount of data upon decompression. This effectively circumvents the intended resource restrictions, leading to uncontrolled disk space consumption and potential system instability or denial of service for other processes sharing the same storage environment.
From a classification perspective, this vulnerability aligns with CWE-787 Out-of-bounds Write in terms of its impact on system resources, although it is more accurately categorized under CWE-400 Uncontrolled Resource Consumption. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1496 Resource Hijacking, where an adversary uses computing resources such as memory or disk space for their own purposes without authorization, potentially causing a denial of service by exhausting system capacity. The exploitation does not require code execution but rather relies on triggering excessive resource allocation through malformed input data, making it particularly dangerous in shared hosting environments or automated pipelines that process untrusted image uploads.
The operational impact of this vulnerability is primarily centered around availability and integrity of the host system's storage resources. By consuming excessive disk space, an attacker can fill up available partitions, causing legitimate applications to fail due to lack of write permissions or temporary file creation capabilities. In severe cases, if the underlying filesystem lacks proper quotas or monitoring, this could lead to broader service outages affecting multiple users or services running on the same infrastructure. There is no indication that this vulnerability allows for arbitrary code execution or direct data exfiltration; its primary threat vector remains resource exhaustion leading to denial of service conditions.
To mitigate this risk, organizations utilizing ImageMagick must ensure they are operating on version 7.1.2-30 or later, or version 6.9.13-55 and later for the legacy branch. These releases contain patches that correct the resource accounting logic within the MAT decoder to properly enforce security policy limits during temporary file generation. Additionally, administrators should review their ImageMagick configuration files to ensure that max-disk-space and memory-limit settings are appropriately tuned for their specific deployment environment. Implementing input validation at the application layer before passing images to ImageMagick can provide an additional defense-in-depth measure, ensuring that only expected data formats and sizes reach the image processing library. Regular updates of third-party dependencies remain critical to maintaining resilience against such resource exhaustion vulnerabilities.