ImageMagick CVE-2026-109266

Exploitation requires that the target application invoke ImageMagick to encode/convert an attacker-influenced image specifically into the CIP (Cisco IP Phone) output format - a rarely-used coder that must be explicitly requested. The injected data originates from the image's Title/label property, or when that is NULL, from the source filename basename, so the attacker must control image metadata or the filename. Limiting factors that reduce realistic risk: CIP output must actually be produced (non-default for most workflows), impact is confined to injecting/corrupting markup in the generated XML (integrity only - no code execution, no confidentiality or availability loss), and downstream effect depends on the XML consumer. No authentication or special privileges are required per the CVSS vector (PR:N).

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9) describes network-reachable, unauthenticated, low-complexity exploitation, but the ONLY impact is low integrity (VI:L) - markup injection into generated Cisco IP Phone (CIP) XML - with no confidentiality (VC:N) and no availability (VA:N) impact. The classification is CWE-79 (XSS), yet the real-world consequence depends entirely on how the downstream CIP XML consumer (a Cisco phone or provisioning backend) parses the injected markup, which is outside ImageMagick's trust boundary. No EPSS score, KEV listing, or POC was provided, so there is no signal of active or imminent exploitation. Realistic risk is further constrained because the CIP encoder is an obscure, rarely-invoked output coder - few deployments ever convert untrusted input to CIP format. Net: a legitimate but low-to-moderate priority issue where high theoretical reachability is offset by niche feature usage and integrity-only impact. Caveat: CVSS marks UI:N, but exploitation practically requires the application to be configured/driven to emit CIP output - verify whether your pipeline ever produces CIP before prioritizing.

An attacker submits a crafted image whose Title metadata (or, if absent, a filename basename) contains XML control characters to a service that uses ImageMagick to render Cisco IP Phone (CIP) output. Because the CIP encoder writes that value into the <Title> element without escaping, the attacker's markup is injected into the generated XML, corrupting or restructuring it. No public exploit code is identified at time of analysis, and impact is limited to the integrity of the produced XML.