CVE-2026-109266 in ImageMagick
Summary
by MITRE • 10/12/2026
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The identified security flaw resides within ImageMagick versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32, specifically affecting the Cisco IP Phone CIP encoder module. This vulnerability is classified as an XML injection issue, which falls under the broader category of CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The core technical deficiency lies in the failure to properly escape input-derived data when generating output files formatted for Cisco IP Phones. When ImageMagick processes an image and converts it into the CIP XML format, it incorporates metadata or pixel data derived from the source file directly into the resulting document without adequate sanitization of special characters such as angle brackets, ampersands, or quotes.
This lack of proper input validation allows a malicious actor to craft a specific image file containing embedded hostile markup. Upon processing this crafted file by an application utilizing the vulnerable version of ImageMagick, the encoder embeds these arbitrary XML elements into the output stream. This behavior deviates from secure coding practices where all external data must be treated as untrusted and strictly neutralized before inclusion in structured data formats like XML. The vulnerability enables attackers to inject arbitrary markup that can alter the structure or content of the generated XML document, potentially leading to further exploitation depending on how the downstream system consumes this output.
The operational impact of this vulnerability is significant for environments where ImageMagick is used as part of a larger pipeline involving Cisco IP Phone configurations or any other application parsing CIP-formatted files. An attacker who can influence the input images processed by such systems could manipulate the resulting XML to execute cross-site scripting attacks if the output is rendered in a web context, perform server-side request forgery through malicious entity references, or cause denial of service conditions via malformed XML structures that crash parsers. In more complex scenarios involving automated configuration management, this injection capability might allow for unauthorized changes to phone settings or network configurations controlled by the parsed XML data.
Mitigation strategies primarily involve upgrading ImageMagick to version 6.9.13-57 or later, and for the major release branch, version 7.1.2-32 or higher, where these encoding issues have been addressed with proper input sanitization mechanisms. For organizations unable to immediately patch their systems, implementing strict file type validation at the ingestion layer is recommended. This includes rejecting any files that do not match expected image formats and applying additional content filtering on images before they are passed to ImageMagick for processing. Additionally, configuring web servers or application firewalls to inspect outgoing XML responses for unexpected markup patterns can provide a secondary defense-in-depth measure against exploitation of this vulnerability in production environments.