CVE Watch15 oct 2026

CVE-2026-102635

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension h

CVSS

3.7

Bajo

EPSS

0.3%

p24

KEV

—

Exploit Today

0-100

Publicado: 29 sept 2026 · Última mod.: 15 oct 2026 · CWE-908

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-09-302026-10-19

Descripción técnica

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-112897—

—

——0Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.11h CVE-2026-1094385.3 MED

28.1%

——83proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.5d CVE-2026-976296.5 MED

6.6%

——2Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.6d CVE-2026-1040865.5 MED

7.9%

——27-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.1d CVE-2026-970118.8 ALT

53.1%

——16Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.5d CVE-2026-968505.5 MED

31.3%

——9Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.4d