ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF
    decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that
    cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing
    sensitive heap information. (CVE-2026-102635)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF     decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that     cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing     sensitive heap information. (CVE-2026-102635)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473226	Echo: imagemagick: security update to 8:7.1.2.33+dfsg1-1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473226	Echo: imagemagick: security update to 8:7.1.2.33+dfsg1-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
351170	Linux Distros Unpatched Vulnerability : CVE-2026-102635	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-102635

medium

Tenable Plugins

medium

medium

medium