CVE-2026-105402

ImageMagick: ImageMagick: Denial of Service via crafted XMP profile

Published Oct 8, 2026 CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected as a duplicate.

No data.

No data available yet.

No solution or workaround provided in the CVE record

No advisories available

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4
https://nvd.nist.gov/vuln/detail/CVE-2026-105402
https://www.cve.org/CVERecord?id=CVE-2026-105402
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-denial-of-service-via-xmp-profile-parsing

History

Type	Values Removed	Values Added
Weaknesses	CWE-400
Metrics	cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Type	Values Removed	Values Added
Description	ImageMagick before 7.1.2-31 contains a denial of service vulnerability that allows attackers to disrupt processing by supplying a crafted XMP profile. Attackers can embed a malicious XMP profile that triggers a failure when determining the numerator and denominator, crashing or hanging image processing.	This CVE ID has been rejected as a duplicate.
Title	ImageMagick before 7.1.2-31 Denial of Service via XMP Profile Parsing	ImageMagick: ImageMagick: Denial of Service via crafted XMP profile
CPEs	cpe:2.3:a:imagemagick:imagemagick::::::::
Metrics	cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Type	Values Removed	Values Added
Weaknesses		CWE-369
References		https://nvd.nist.gov/vuln/detail/CVE-2026-105402 https://www.cve.org/CVERecord?id=CVE-2026-105402
Metrics	threat_severity `None`	threat_severity `Moderate`

Type	Values Removed	Values Added
Description		ImageMagick before 7.1.2-31 contains a denial of service vulnerability that allows attackers to disrupt processing by supplying a crafted XMP profile. Attackers can embed a malicious XMP profile that triggers a failure when determining the numerator and denominator, crashing or hanging image processing.
Title		ImageMagick before 7.1.2-31 Denial of Service via XMP Profile Parsing
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-400
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4 https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-denial-of-service-via-xmp-profile-parsing
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`