---
id: CVE-2026-109276
title: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete
  cleanup flaw in the JNG decoder that fails to remove temporary files when
  processing crafted input
summary: >-
  ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete
  cleanup flaw in the JNG decoder that fails to remove temporary files when
  processing crafted input. Attackers can submit crafted JNG files for
  processing to repe…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-459
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:20.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109276'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.185Z'
---

## Overview

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.