ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files… (CVE-2026-109276)

A vulnerability identified as CVE-2026-109276 affects ImageMagick versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32. The issue lies in the JNG decoder component, which fails to remove temporary files when processing specially crafted JNG files. This incomplete cleanup can cause accumulation of temporary files, leading to disk space exhaustion and reduced availability of the affected system or service.

The vulnerability does not impact confidentiality or integrity but can cause a denial of service condition by exhausting disk space through repeated leakage of temporary files. This degradation of availability can affect systems processing untrusted JNG images with vulnerable ImageMagick versions.

The vulnerability affects ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32. Users should upgrade to version 6.9.13-57 or later, or 7.1.2-32 or later, where this issue is fixed. Patch status is not explicitly confirmed in the provided data, but the version boundaries indicate fixed versions. No vendor advisory content is provided, so verify with the official ImageMagick advisories for current remediation guidance.