ImageMagick CVE-2026-109259

Exploitation requires that the target invoke ImageMagick's TGA (Truevision Targa) decoder on an attacker-controlled image file - i.e., any upload, conversion, or thumbnail pipeline that accepts and auto-processes TGA input. The concrete trigger is the uninitialized 'buffer[325]' stack array and 'tga_info' struct in ReadTGAImage (coders/tga.c), so only the TGA code path is affected, not other formats. Key limiting factors: the attacker must be able to retrieve or observe the decoder's output to recover the leaked bytes; disclosed data is non-deterministic uninitialized stack memory (no guaranteed capture of specific secrets); and only ImageMagick versions before 6.9.13-57 (6.x) and before 7.1.2-32 (7.x) are vulnerable. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N) where the processing is automated.

This is a moderate-severity information-disclosure flaw, not a top-tier priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with only VC:L (low confidentiality, no integrity or availability impact) scores 6.9, and the underlying issue - an uninitialized stack buffer (buffer[325]) and uninitialized tga_info struct in the TGA decoder, confirmed by the patch diffs - leaks process memory contents rather than enabling code execution. Exploitation status is 'no public exploit identified at time of analysis': this CVE is NOT in CISA KEV and no POC is referenced in the provided data. No EPSS score was provided, so real-world exploitation probability cannot be quantified here. The combination of broad reachability (any service that auto-processes attacker-supplied images) against a ubiquitous library elevates practical concern above the raw score, but the impact ceiling is low - attackers obtain fragments of uninitialized memory, not reliable arbitrary read or RCE. Net: a worthwhile patch-management item, especially for image-processing pipelines, but not an emergency absent evidence of active exploitation.

An attacker uploads a specially crafted TGA image to a web application or service that uses ImageMagick to decode, resize, or convert images. When ImageMagick's TGA decoder processes the file, it reads from an uninitialized stack buffer and emits the leaked bytes into the output image, which the attacker then retrieves, exposing fragments of uninitialized process memory. No public exploit code is identified in the provided data, but the patch commits publicly reveal the exact uninitialized variables, lowering the bar to reproduce.