ImageMagick CVE-2026-109273

Exploitation requires that the target application decode an attacker-supplied PostScript (PS) file through ImageMagick's internal PS coder and that the one leaked byte be observable in returned output (e.g., the generated image's ICC profile or converted result). The flaw is in the ICC-profile handling within ReadPSInfo in coders/ps.c, so the crafted file must reach the PostScript decode path; deployments that disable the PS/PostScript coder via policy.xml, or that never process PostScript input, are not exposed. Limiting factors: the impact is capped at a SINGLE uninitialized byte per request (no multi-byte or chosen-address read), there is no integrity or availability effect, and the attacker must have a channel that reflects the decoder output back to them - reducing real-world value even though no authentication or user interaction is required.

This is a low-to-moderate priority issue despite its 6.9 CVSS 4.0 score. The vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) correctly reflects a remotely reachable, unauthenticated, low-complexity trigger with only LOW confidentiality impact and no integrity or availability impact - consistent with the description, which discloses exactly ONE uninitialized byte of process memory per crafted file (CWE-908). The high-looking score is driven by the easy network-reachable trigger, not by impact severity: a single leaked byte is of minimal intelligence value on its own and is not directly code-execution or credential-disclosure. No EPSS score, KEV listing, or public exploit was provided in the input; it is not on CISA KEV and no public exploit identified at time of analysis, so there is no evidence of active or at-scale exploitation. The 'source code evidence' in the input is the vendor PATCH diff (off-by-one in SetStringInfoLength, allocating i+1 instead of i bytes), not an exploit - do not conflate patch availability with POC availability. Net: patch promptly during normal maintenance, but this does not warrant emergency response.

An attacker submits a crafted PostScript file to a web application or pipeline that uses ImageMagick to decode or convert uploaded images. The PostScript decoder allocates an ICC-profile buffer one byte longer than the decoded data, and that trailing uninitialized byte of heap memory is returned embedded in the output, leaking a single byte of process memory contents to the attacker. No public exploit code was provided in the input, and the vendor commit referenced is the fix, not a weaponized POC.