ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape… (CVE-2026-109266)
Description
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have an XML injection vulnerability in the CIP encoder. This flaw occurs because the encoder does not properly escape input-derived data when generating Cisco IP Phone XML output. An attacker can craft a file that, when converted to CIP format, injects arbitrary XML markup. The vulnerability has a medium severity with a CVSS score of 5.3.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/imagemagick/ImageMagickRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109266 describes an XML injection vulnerability in ImageMagick's CIP encoder present in versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32. The vulnerability arises from improper escaping of input-derived data during the generation of Cisco IP Phone XML output, allowing attackers to inject arbitrary XML markup by supplying a specially crafted file converted to CIP format.
Potential Impact
The vulnerability allows an attacker to inject arbitrary XML markup into the generated Cisco IP Phone XML output. This could potentially lead to downstream processing issues or manipulation of XML data. The CVSS score of 5.3 indicates a medium impact, with no confidentiality or availability impact, but an integrity impact due to injection of unauthorized markup.
Mitigation Recommendations
A fix is available in ImageMagick versions 6.9.13-57 and 7.1.2-32 and later. Users should upgrade to these or newer versions to remediate this vulnerability. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the version boundaries stated in the description.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j882-xwcv-qg6m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-109266"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6acd55502cdf04f656da8543
Added to database: 10/12/2026, 21:46:56 UTC
Last enriched: 10/12/2026, 21:56:51 UTC
Last updated: 10/13/2026, 02:48:21 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.