CVE-2026-106569 PUBLISHED

ImageMagick: Denial of service in ASE decoder because of missing security checks

Assigner: GitHub_M
Reserved: 06.10.2026 Published: 07.10.2026 Updated: 07.10.2026

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	ImageMagick
Product	ImageMagick
Versions	Version < 7.1.2-32 is affected

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63
https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388
https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32

Problem Types

CWE-770: Allocation of Resources Without Limits or Throttling CWE
CWE-789: Memory Allocation with Excessive Size Value CWE