ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.
{
"cna_assigner": "VulnCheck",
"cwe_ids": [
"CWE-908"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102635.json",
"unresolved_ranges": [
{
"extracted_events": [
{
"introduced": "7.0.0-0"
},
{
"fixed": "7.1.2-32"
}
],
"source": "AFFECTED_FIELD"
}
]
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102635.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "287862567460969081314764391007188859714",
"length": 10623
},
"id": "CVE-2026-102635-06ed0c57",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5",
"target": {
"file": "coders/gif.c",
"function": "ReadGIFImage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166671297581180298913858864259992937619",
"87522090532774163777948432090791094803",
"144389624087589022150998189781966874235",
"193886936074533204763717866755932057300",
"317477898423325105034544982288466895079",
"210062456552976206253438246109240335954",
"297012926689877834460271438556963737128",
"35876810706430644948653049731275811100",
"240171065706668824593916806180331180638",
"256765894362693672700832344348410633047",
"223800661121450053799143639310445333682",
"13589576830901754176319406399531403799",
"275342048815679923358282581773857235576",
"65518914492217940816352745802292721354",
"246562708047587331168960111322329814157",
"259868588935487854938905195437125573143",
"318744951494606779091007176640690292789",
"90379782083629408482843526475995099381",
"34734937521922370086909951234818462631",
"328361030636500036290095728585720622367",
"311605124575647312088571887837727080262",
"332102853951010478474276772530591237178",
"170620388554962595182563493364932680063",
"118498231077547532321667461776443868384",
"140307906629573680695380076490102090210",
"28382733933797675649881524144271076241",
"243229665261383030422819266758277171165",
"65309759257925387987492578742884657034",
"73989987012348626818844930547435934413",
"9291605620177844374883425302753111467",
"322123678214925669215369646749992666289",
"83985387031669366098092284236288556810",
"145814122175880831217910576525300758312",
"65977008141989011871553478983703780987",
"194821667192001311856347591054472145794",
"134079663791765822474137416700347811791",
"307337922029405693907655527673081884735",
"64656492258854098492780272411373164473",
"142464345754191229409731018987102809651",
"203839828634854031611414303928593376050",
"174395583912156159522319465921868848864",
"7558842643886532241563315578691436203",
"129285146557937610687127094545528102188",
"42155391546780542263550305562230545512",
"177537464462121679020744651809203177670",
"92213236486333413486068279591893026749",
"302553432514783284099563200303432057495",
"108260675974002771977648157782912987513",
"138661518583272442136552029865407237704",
"56059441105035435299486419431054071438",
"280441087555460364308615697765844338176",
"150778138717180017931830448140345021925",
"99824348675089028989857845068490309101",
"239569902546635949226320775982714371274",
"64463011130827363449419330250384781813",
"57426164883059140666641375392931369970",
"19584776460831608377307777131382523762",
"265358540851916710478264973118501752984",
"177816435719921769589561169104604314156",
"268855223713856320510124394348717923199",
"154265057514054437988213596774950916819",
"172419929348095541804181041483710648541",
"107878155342149258334846040343092567356",
"124213032444750228217400737258201927549",
"274899568174910767547059977534114847799",
"88589282222102549596944526408033397699",
"183201512577884565966926875299782906923",
"193881636521093126253068317195041866033",
"83666913479776321709893863136897021711",
"178971037371245265047407242590104957981",
"118247036947916164597182549028688579833",
"92717267696002360371903814572874641843",
"116270124539951153940967547789135922498",
"42215027088547022319524284716971032103",
"261035239866435119938286704572307277481",
"183201512577884565966926875299782906923",
"193881636521093126253068317195041866033",
"318406925078102567565787906455027135966",
"283006324329958977864669491014253786245",
"258059744935836448513609068065629310204",
"282679946901270602624324859561495658673",
"323614981542341081050796452227190354689",
"103102691557831029812873258264455930422",
"9547697590443213500178391705034602874",
"26960951892894958488844141921312922271",
"129247265580625344461464413709115414732",
"14385396014393942048953834434069063630",
"331225980234297970685124542774541505191",
"174844630382814241605141295830399484507",
"227862723568869343787214000221609389323",
"169614847788368844170939089614355656915",
"320185302738248298002133437076298496891",
"84593408857089033982884055677139186381",
"326359809362226796541379103751415948484",
"19249155537191644030782830186664699378",
"277450079178718384767705631005223360289",
"335810666462928733896623434107632522755",
"217686246291492849290074933640463120152",
"21467504630718225390498451400418152602",
"12107921150731278974832008686879001640",
"57778763247481616798706606277527906273",
"59076070626811093510332577161170673224",
"336533492017195810553087170545815518750",
"23606743075964277698263880254590954958",
"124888105545243170569967172797025794102",
"93874988735166292402916419490109380409",
"172572521693954626916528770019528746116",
"18109905741285251012175914807313051249",
"172397210954310268230949611838121246002"
],
"threshold": 0.9
},
"id": "CVE-2026-102635-1305db5f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5",
"target": {
"file": "coders/gif.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"193886936074533204763717866755932057300",
"317477898423325105034544982288466895079",
"210062456552976206253438246109240335954",
"297012926689877834460271438556963737128",
"35876810706430644948653049731275811100",
"240171065706668824593916806180331180638",
"256765894362693672700832344348410633047",
"223800661121450053799143639310445333682",
"13589576830901754176319406399531403799",
"275342048815679923358282581773857235576",
"65518914492217940816352745802292721354",
"246562708047587331168960111322329814157",
"259868588935487854938905195437125573143",
"318744951494606779091007176640690292789",
"90379782083629408482843526475995099381",
"34734937521922370086909951234818462631",
"328361030636500036290095728585720622367",
"88436076605935510728549436819065018064",
"335247983779148119158652911656720884606",
"102493553950198393764032829348179027662",
"335301134529067643593228530826592295279",
"140307906629573680695380076490102090210",
"28382733933797675649881524144271076241",
"131294105797389829574936437026644127836",
"119150007897022480485600353589489094795",
"164509262721932599570450034680412657811",
"332865915129044156083478649989990732777",
"26463603617757829052347540221607091157",
"131600180068795536175432832209073899853",
"191648380384241045019220571580922771707",
"137346974118735040356890207259699125834",
"79931388364092637128386634862521315391",
"78749116425067463521249983272772806068",
"71654067532119524100248306844820215388",
"224558788916862377741309585016362165896",
"257563087401814055375459139442885186435",
"242556045633612486126974909120594128228",
"257731273162014602807291299521992952407",
"204020777941483199958657687753385957701",
"294778840379628741623530958273228049829",
"108260675974002771977648157782912987513",
"138661518583272442136552029865407237704",
"56059441105035435299486419431054071438",
"193118589259050976647682951554012447683",
"248090280760557882554087225067059209532",
"221510358120058346274233039825287527243",
"1504714564532957790179407971456812640",
"64463011130827363449419330250384781813",
"57426164883059140666641375392931369970",
"19584776460831608377307777131382523762",
"265358540851916710478264973118501752984",
"177816435719921769589561169104604314156",
"268855223713856320510124394348717923199",
"154265057514054437988213596774950916819",
"172419929348095541804181041483710648541",
"107878155342149258334846040343092567356",
"124213032444750228217400737258201927549",
"274899568174910767547059977534114847799",
"88589282222102549596944526408033397699",
"183201512577884565966926875299782906923",
"193881636521093126253068317195041866033",
"83666913479776321709893863136897021711",
"178971037371245265047407242590104957981",
"93064377792483830959211586590428472641",
"173101575368717278348736651987343135243",
"146402396617707657605063068931323700382",
"165221194657370216030394271750118672873",
"193510616582103352519343527086566466518",
"104096754803203571982724390986842198560",
"180897267233093893783754031497582949018",
"223861126821984595096603036137782974455",
"73952646137092306918454868793862013272",
"231265071181097490120646953219739637847",
"48391096798449092044581056221767604606",
"182721380114828672041589042890775183281",
"309556183223601946567129155674186162011",
"83394454811112035845761474327176780879",
"97889870517662523165999263307305949165",
"226557728559637208855109896114228604487",
"53067669973053908363099255131156053157",
"279794942755913410536305347447093065082",
"221777401579862125875006200351374027623",
"129171541441945633704879949621702919702",
"123699978856672617131735585351550925510",
"22213939160561023148292663122578695610",
"18109905741285251012175914807313051249",
"172397210954310268230949611838121246002"
],
"threshold": 0.9
},
"id": "CVE-2026-102635-68608ddf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4",
"target": {
"file": "coders/gif.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "3788104428362671027437627211657978736",
"length": 10206
},
"id": "CVE-2026-102635-fd494446",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4",
"target": {
"file": "coders/gif.c",
"function": "ReadGIFImage"
}
}
]
"2026-10-01T14:22:40Z"