ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.
{
"cna_assigner": "VulnCheck",
"cwe_ids": [
"CWE-674"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109264.json"
}{
"extracted_events": [
{
"introduced": "7.0.0-0"
},
{
"fixed": "7.1.2-32"
}
],
"source": "AFFECTED_FIELD"
}
{
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "6.9.13-57"
}
],
"source": [
"DESCRIPTION",
"REFERENCES"
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109264.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "83269636961834423847654298257606464842",
"length": 968
},
"id": "CVE-2026-109264-1c3e05c4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "magick/image.c",
"function": "GetImageInfo"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"120752180671095613983385292599602691103",
"64867838521663742061249640584989989844",
"48140866262985294636875120439197406579",
"321454277464876399669226377251865848368",
"163659168563578789392202092163244467858",
"270846501811549859358625129792566636242",
"138249857992032214410261382918795684445",
"248274857836918891302005728512204107136",
"78978317459124733810473545023424371409",
"181291914848360379346415901840202619573",
"53725991827846970717188279744860126958",
"1444430099073902845931917803176097570",
"161579372259195827323238863338802997393",
"317587954149836702933009346796027236763",
"104211461227081254724132171101341104449",
"240402524972030162293325639690506890085",
"245252952344626147775850255839690239300",
"112554844774486908334600837681552613727",
"212884797463615561624613749043301631332",
"107779269851730054780408665464352974088",
"190059126279217643163629367300476855144",
"317699526611762084673286494781425308677",
"312476128515209916558532259787195134145",
"101479007164736261527311124437442567129",
"256137591510308049882361295379703108199",
"170374530164649314391679638025169963622",
"339898473445801421306484260736789979650",
"13783560042305945646570069863405552035",
"9397943425536423416416186477327672547",
"166503451983530707389976659335816449223",
"182599385254655847021125808314111925750",
"325300205354279526456438241312877608713",
"124125237192395710856290366560545233082",
"334831581297990194419323547985657268729",
"209896649266675347046176219003366356761",
"77063926230336259384630217112471506198",
"312108837243111004999291009813959229696",
"46473495509323407710941528339884542784"
],
"threshold": 0.9
},
"id": "CVE-2026-109264-1cd1d924",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "coders/svg.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"84232869127054365340067041903787391097",
"268255742605707986606336515406933065744",
"271681661034407156106450430982810488354",
"5665654769070665944493303940532970382"
],
"threshold": 0.9
},
"id": "CVE-2026-109264-39b4ee96",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "magick/constitute.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288924862211656244910447868784373819848",
"238556251246797739313335496370736676574",
"312988526911114914598184498628592598178",
"111955414633986060793591454354644981693"
],
"threshold": 0.9
},
"id": "CVE-2026-109264-7000ff02",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "magick/draw.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"68831958852660960742685251441588122387",
"114559917380285881061541647194836273541",
"306714245292962451593867878550541956681",
"191055380599826511273556723250267135593"
],
"threshold": 0.9
},
"id": "CVE-2026-109264-87a36a75",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "magick/image.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "20714165545250173288901816892473293982",
"length": 3426
},
"id": "CVE-2026-109264-a5f2f948",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "magick/image.c",
"function": "CloneImageInfo"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"77956169110862942730149705444728683909",
"230606847277135608425336109470951843579",
"265914032089385474368408109523593051869",
"231611725107944483215659512930075760447",
"103967809460764209829891495158129467195",
"79543976072807349428853042577258837905",
"198668489583574914705500368009787948086",
"318065080238397353451828391586203828079"
],
"threshold": 0.9
},
"id": "CVE-2026-109264-b73490aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "magick/image.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "96565698787896458611618445133183100701",
"length": 194
},
"id": "CVE-2026-109264-b990fb86",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "coders/svg.c",
"function": "UnregisterSVGImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "195839424837161024625037003867365193214",
"length": 8688
},
"id": "CVE-2026-109264-c30cb731",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "coders/svg.c",
"function": "SVGEndElement"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "241694394272378047397196565212261549533",
"length": 11676
},
"id": "CVE-2026-109264-d4f373a5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "magick/constitute.c",
"function": "ReadImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "180052580946886676916961201073393084629",
"length": 2574
},
"id": "CVE-2026-109264-e52b7ae8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "coders/svg.c",
"function": "RegisterSVGImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "33503971175549377679436230989259039572",
"length": 10095
},
"id": "CVE-2026-109264-ed36dbe5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2",
"target": {
"file": "magick/draw.c",
"function": "DrawPrimitive"
}
}
]
"2026-10-14T07:05:49Z"