Dashboard / CVE-2026-109276

CVE-2026-109276

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 74/100
Published: 2026-10-12 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: None
VI: None
VA: Low

Description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
imagemagick imagemagick < 6.9.13-57

References & Advisories (4)

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.38%
Raw Score 0.003840
Percentile 33.0%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00384
2026-11-13
0.00384
2026-11-12
0.00384
2026-11-10
0.00384
2026-11-09
0.00384
2026-11-08
0.00384
2026-11-07
0.00384
2026-11-06
0.00384
2026-11-05
0.00384
2026-11-04
0.00384
2026-11-03
0.00384

Intelligence Sources

nvd ref →

External Links