CVE-2026-105404

Executive Summary

CVE-2026-105404 is a code injection vulnerability (CWE-94) in ImageMagick's PostScript coders, present in versions before 6.9.13-56 and 7.x before 7.1.2-31. The flaw arises because certain values are not properly escaped or trimmed before being written to output, allowing crafted input to embed arbitrary PostScript code into generated files. Systems that use ImageMagick to convert untrusted images into PostScript-derived output (e.g., PDF, PS, EPS) are affected, with a CVSS score of 5.3 reflecting high confidentiality impact offset by high attack complexity and required user interaction.

Technical Analysis

ImageMagick is a widely deployed image processing library and toolkit used both as a command-line utility and as a dependency of many web applications. The vulnerability described is specifically located in the PostScript coders — the modules that read and write PostScript-family formats. The root cause, per the NVD description, is improper escaping and trimming of values before those values are written to output. ImageMagick coders frequently assemble textual output by concatenating metadata- or content-derived values directly into the file being produced. When escaping/trimming is omitted, an attacker-controlled value can terminate its intended context and inject additional PostScript statements of the attacker's choosing. This is a classic injection pattern: user-influenced data crosses into an interpreter (here, the PostScript interpreter on the consumer side), and no neutralization is applied.

The weakness maps to CWE-94 (Improper Control of Generation of Code / Code Injection). Note that the CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network reachability, high attack complexity, no privileges required, and required user interaction — consistent with a scenario in which a victim must open or process a maliciously crafted file with a PostScript-capable consumer. Scope is unchanged (S:U) and only confidentiality is impacted (C:H), with integrity and availability unaffected.

Because the untrusted input enters at ImageMagick's conversion stage and the injected code executes in whatever PostScript interpreter ultimately consumes the generated file, the vulnerability bridges two components: the ImageMagick process that generates the file, and the downstream renderer that executes it. The description does not name specific functions, parameters, or file paths; therefore the analysis remains at the vulnerability-class level and no fabricated code identifiers are presented.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (code injection via unescaped values written into generated PostScript output).

1. Reconnaissance/target identification. An attacker identifies a target that accepts untrusted image input and uses ImageMagick to produce PostScript-family output (PDF/PS/EPS) or otherwise routes data through the PostScript coders. Web applications that offer "convert my image to PDF" or thumbnail/report-generation features are candidate surfaces. Attackers may fingerprint ImageMagick behavior via format handling differences.

2. Triggering the flaw class. The attacker supplies crafted values — for example within image metadata or content fields that ImageMagick later writes into generated PostScript output. Because these values are not escaped or trimmed, the data is emitted verbatim into the output stream rather than being safely encoded.

3. Payload/execution method. The crafted value embeds arbitrary PostScript code. When the generated file is subsequently opened or processed by a PostScript interpreter (e.g., a PDF/PS viewer or print pipeline), that interpreter executes the injected PostScript. At the vulnerability-class level, this is an injection-into-interpreter execution: the attacker converts a data-handling omission into code execution within the consuming renderer's context.

4. Post-exploitation impact. Per the CVSS assessment, the demonstrated impact is high confidentiality loss (C:H). Injected PostScript can cause the consuming interpreter to read and exfiltrate file contents accessible to it, or to invoke interpreter features that disclose data. Integrity and availability are not impacted under the assigned vector. Because UI:R is required, the victim must interact with (open/process) the crafted or generated file for the chain to complete.

Important caveat: the NVD description does not specify exact injectable fields, functions, or payload bytes. Any concrete payload construction would be speculation and is therefore not provided.

Impact Assessment

• Confidentiality (C:H): Highest-rated subscore. Successful exploitation can lead to disclosure of information accessible to the PostScript interpreter processing the generated file.
• Integrity (I:N) / Availability (A:N): No assigned impact, narrowing the primary risk to data exposure rather than data destruction or denial of service.
• Attack vector (AV:N): Remotely reachable; the crafted input can be delivered over a network.
• Attack complexity (AC:H): Exploitation is non-trivial — conditions such as a suitable processing path, a PostScript-capable consumer, and successful injection must align.
• Privileges required (PR:N): No authentication needed to supply crafted input.
• User interaction (UI:R): A victim must open or process the affected/generated file.
• Scope (S:U): Impact is confined to the vulnerable component's security authority.

Blast radius: any deployment — web service, document pipeline, or desktop workflow — that uses an affected ImageMagick version to handle untrusted input and produces or forwards PostScript-family output. Because ImageMagick is a common transitive dependency, the true exposure often exceeds the immediately visible application. Business impact centers on potential exfiltration of sensitive data rendered or referenced through document conversion workflows.

Detection Guidance

Sigma Rule

title: ImageMagick PostScript Coder Injection Attempt (CVE-2026-105404)
id: 9f3c1a72-5b4e-4d1a-8c2f-cve2026105404
status: experimental
description: Detects ImageMagick invocations converting untrusted input to PostScript/PDF-family output, which may carry injected PostScript for CVE-2026-105404.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105404
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/convert'
      - '/magick'
      - '/mogrify'
  selection_ps:
    CommandLine|contains:
      - '.ps'
      - '.eps'
      - '.pdf'
      - 'ps:'
      - 'ps2:'
      - 'ps3:'
  condition: selection_img and selection_ps
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate document conversion pipelines
level: medium
tags:
  - attack.t1059
  - cve.2026-105404

YARA Rule

rule CVE_2026_105404_ImageMagick_PostScript_Injection
{
    meta:
        description = "Detects PostScript output files containing suspicious embedded PostScript markers potentially injected via CVE-2026-105404"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105404"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ps_begin = "%!PS-Adobe" ascii
        $inject1 = "{ }" ascii
        $inject2 = "system" ascii nocase
        $inject3 = "file" ascii nocase
        $inject4 = "exec" ascii nocase
        $inject5 = "(%pipe%" ascii nocase
        $producer = "ImageMagick" ascii

    condition:
        $ps_begin at 0 and $producer and any of ($inject*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105404 ImageMagick PostScript Coder Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Content-Type"; content:"multipart/form-data"; http.request_body; content:"%!PS"; nocase; content:"ImageMagick"; nocase; reference:cve,2026-105404; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105404; classtype:attempted-user; sid:2026105404; rev:1;)

Elastic Detection

process where event.type == "start" and
  (process.name in ("convert", "magick", "mogrify")) and
  process.command_line : ("*.ps*" or "*.eps*" or "*.pdf*" or "*ps:*" or "*ps2:*")

Splunk SPL Query

index=main sourcetype=process_creation OR sourcetype=sysmon
(Image="*convert" OR Image="*magick" OR Image="*mogrify")
(CommandLine="*.ps*" OR CommandLine="*.eps*" OR CommandLine="*.pdf*" OR CommandLine="*ps:*")
| stats count by host, User, Image, CommandLine
| where count > 0

Wazuh OSSEC Rule

<group name="imagemagick,cve-2026-105404,">
  <rule id="2026105" level="7">
    <if_sid>592</if_sid>
    <field name="win.eventdata.image">convert|magick|mogrify</field>
    <field name="win.eventdata.commandLine">\.ps|\.eps|\.pdf|ps:</field>
    <description>CVE-2026-105404: Possible ImageMagick PostScript coder injection attempt</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Treat all image input as untrusted and avoid passing attacker-influenced data through the PostScript coders until a patched version is available.
   • Where PostScript/PDF conversion of untrusted input is not required, restrict allowed formats and disable PostScript-family handling in ImageMagick policy configuration.
   • Sandbox document conversion services (containerization, least-privilege service accounts) and prevent generated documents from auto-executing in PostScript-capable renderers.
   • Do not open or process PostScript/PDF files generated from untrusted sources in environments where the consuming interpreter can reach sensitive data (UI:R is required, so user awareness is directly relevant).

2. Patch/upgrade steps

   • The version boundaries given are 6.9.13-56 (for the 6.x line) and 7.1.2-31 (for the 7.x line). No patch evidence is currently tracked from any source, so confirm with the vendor that these versions contain the escaping/trimming fix before relying on them.
   • Plan upgrades to at least these versions once vendor confirmation is obtained; audit transitive dependencies (libraries and applications embedding ImageMagick) to identify all affected paths.

3. Long-term hardening

   • Maintain a dependency inventory to rapidly locate embedded ImageMagick instances.
   • Enforce strict input validation and output encoding at application boundaries that feed conversion pipelines.
   • Apply the principle of least privilege to any component that renders or executes generated PostScript-family files.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105404
• CWE-94 (Improper Control of Generation of Code / Code Injection): https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK T1059 (Command and Scripting Interpreter): https://attack.mitre.org/techniques/T1059/
• ImageMagick project documentation and security policy: https://imagemagick.org/ (verify vendor advisories for the 6.9.13-56 and 7.1.2-31 release notes)
• CISA KEV catalog (check for future inclusion): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public exploit code, Nuclei template, or exploit-in-the-wild evidence is available for CVE-2026-105404 at the time of writing; no threat actor campaigns are associated with this identifier in the provided data.