ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and… (CVE-2026-109279)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 suffers from a race condition triggered by simultaneous reads and writes to the security policy without proper synchronization. This race condition leads to a heap buffer overwrite, which can crash the application. An attacker capable of inducing concurrent access to the security policy can exploit this to cause denial of service. The vulnerability does not affect confidentiality or integrity.

The vulnerability allows an attacker with the ability to cause concurrent security policy access to crash the application, resulting in denial of service. There is no impact on confidentiality or integrity. The CVSS score of 2.5 (low) reflects this limited impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid scenarios where multiple threads can concurrently access and modify the security policy to reduce risk.