ImageMagick CVE-2026-109276

Exploitation requires the target application to accept and process attacker-supplied JNG (JPEG Network Graphics) files through ImageMagick's JNG decoder in coders/png.c (vulnerable builds before 6.9.13-57, or 7.x before 7.1.2-32). The specific trigger is JNG input whose DestroyJNG path fails to relinquish the unique temporary files created for the color and alpha sub-images. Meaningful impact is LIMITED by its cumulative nature: a single file leaks only a small amount of disk, so an attacker must submit many crafted files repeatedly to exhaust the filesystem, and impact depends on available disk headroom and temp-directory quotas. The vector is only truly remote/unauthenticated where an internet- or user-facing feature routes uploads into ImageMagick; batch or offline-only usage reduces this to local/config-dependent exposure.

This is a genuine but moderate-severity availability issue, not a top-tier emergency. The vendor-supplied CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated, no-interaction triggering, but the only impact is VA:L - a low availability hit via gradual disk exhaustion from leaked temporary files (CWE-459, incomplete cleanup). Confidentiality and integrity impacts are explicitly N, so despite the 'Information Disclosure' tag in the input, no data exposure occurs - the tag conflicts with both the description and the CVSS vector and should be disregarded (data is leaked to disk as orphaned temp files, not disclosed to the attacker). No EPSS score was provided, the CVE is NOT on CISA KEV, and no POC was supplied, so there is no public exploit identified at time of analysis. The score of 6.9 is driven by easy remote reachability rather than impact magnitude; the practical risk is a slow denial-of-service requiring sustained repeated submissions to meaningfully consume disk, making this a patch-on-normal-cycle item rather than an exploited-in-the-wild priority. Note the apparent scope mismatch is minor: AV:N is justified only when the application exposes ImageMagick-backed image processing to untrusted input; in offline/batch-only deployments the realistic vector is closer to local.

An attacker repeatedly uploads crafted JNG files to a web application that uses ImageMagick for server-side image processing (e.g., avatar or attachment handling). Each decode leaves orphaned temporary files for the color and alpha sub-images that are never relinquished, so sustained submissions steadily consume disk space until the filesystem fills and the service degrades or fails. No public exploit code was provided, and no authentication or user interaction is required where the processing endpoint is reachable.