Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.
Affected products
imagemagick: imagemagick
References4
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f98… Vendor Advisory
- github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8… Patch
- github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf… Patch
- www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7… Third Party Advisory
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 4.0
-
6.9
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 33 · as of 11 November 2026
- CWE
- CWE-459
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.