CVE-2026-109259
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory c
CVSS
5.3
Média
EPSS
0.3%
p24
KEV
—
Exploit Today
7
0-100
Publicado: 12 de out. de 2026 · Última mod.: 3 de nov. de 2026 · CWE-200
0.3%EPSS · 30 dias0.3%
2026-10-132026-11-06
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.
- github.comhttps://github.com/ImageMagick/ImageMagick/commit/8e809498fd328256612ee9c0ff7941bd452a0285
- github.comhttps://github.com/ImageMagick/ImageMagick/commit/df199b79f0a1c87ca009e431f03cb387af160f77
- github.comhttps://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h499-883p-vph8
- github.comhttps://github.com/ImageMagick/ImageMagick6/commit/9c7c5f9f5fcc9e23f0a8fda830cecfbb3310fbd9
- www.vulncheck.comhttps://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-information-disclosure-in-tga-decoder
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-628567.7 ALT—
——0FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. This issue is fixed in version 1.8.226.10hCVE-2026-628526.5 MÉD—
——0FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.10hCVE-2026-628514.3 MÉD—
——0FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in ConversationsController::search() resolves a user-controlled ticket number without applying the mailbox filter or view policy used by the normal search path. An authenticated non-admin agent who is a member of at least one mailbox can request /search with a hash-prefixed ticket number and use the 302 Location header to confirm that a conversation exists in a different mailbox the agent cannot access and learn its internal conversation and folder identifiers. The destination conversation remains protected, so this issue does not disclose message content, attachments, or customer data. This issue is fixed in version 1.8.226.10hCVE-2026-669843.1 BAI—
——0HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information could help an attacker understand the application structure and plan further attacks, potentially resulting in unintended behavior or security impact under certain conditions.11hCVE-2026-351134.8 MÉD—
——0HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.11hCVE-2026-351124.2 MÉD—
——0HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions.11h