[ Vendor · 56 CVEs ]
ImageMagick
CVEs affecting ImageMagick published in the last 30 days, plus any ImageMagick CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109964 | 13 Oct 2026 | CVSS 5.6 | ImageMagickImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to… | |
| CVE-2026-109282 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method… | |
| CVE-2026-109276 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when… | |
| CVE-2026-109277 | 12 Oct 2026 | CVSS 3.3 | ImageMagickImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling… | |
| CVE-2026-109278 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory… | |
| CVE-2026-109279 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and… | |
| CVE-2026-109280 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a… | |
| CVE-2026-109281 | 12 Oct 2026 | CVSS 4.4 | ImageMagickImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond… | |
| CVE-2026-109269 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that… | |
| CVE-2026-109270 | 12 Oct 2026 | CVSS 3.3 | ImageMagickImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations… | |
| CVE-2026-109271 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during… | |
| CVE-2026-109272 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached… | |
| CVE-2026-109273 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a… | |
| CVE-2026-109274 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy… | |
| CVE-2026-109275 | 12 Oct 2026 | CVSS 4.8 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used… | |
| CVE-2026-109262 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory… | |
| CVE-2026-109263 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a… | |
| CVE-2026-109264 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An… | |
| CVE-2026-109265 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to… | |
| CVE-2026-109266 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape… | |
| CVE-2026-109267 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to… | |
| CVE-2026-109268 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000… | |
| CVE-2026-109258 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX… | |
| CVE-2026-109259 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents… | |
| CVE-2026-109260 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng… | |
| CVE-2026-109261 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color… | |
| CVE-2026-105081 | 12 Oct 2026 | CVSS 3.6 | ImageMagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy… | |
| CVE-2026-108693 | 11 Oct 2026 | CVSS 7.0 | ImageMagickImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches… | |
| CVE-2026-107210 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly… | Fix |
| CVE-2026-107208 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile… | Fix |
| CVE-2026-107209 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is… | Fix |
| CVE-2026-106577 | 7 Oct 2026 | CVSS 6.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or… | Fix |
| CVE-2026-106578 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can… | Fix |
| CVE-2026-106579 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can… | Fix |
| CVE-2026-106580 | 7 Oct 2026 | CVSS 8.2 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing… | Fix |
| CVE-2026-106572 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing… | Fix |
| CVE-2026-106573 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check… | Fix |
| CVE-2026-106574 | 7 Oct 2026 | CVSS 6.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the… | Fix |
| CVE-2026-106575 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause… | Fix |
| CVE-2026-106576 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger… | Fix |
| CVE-2026-106569 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource… | Fix |
| CVE-2026-106570 | 7 Oct 2026 | CVSS 6.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network… | Fix |
| CVE-2026-106571 | 7 Oct 2026 | CVSS 5.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call… | Fix |
| CVE-2026-106568 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile… | Fix |
| CVE-2026-106564 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the… | Fix |
| CVE-2026-106565 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file… | Fix |
| CVE-2026-106566 | 7 Oct 2026 | CVSS 4.4 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not… | Fix |
| CVE-2026-106567 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file… | Fix |
| CVE-2026-105083 | 3 Oct 2026 | CVSS 4.2 | ImageMagickImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when… | Fix |
| CVE-2026-102635 | 29 Sep 2026 | CVSS 5.3 | ImageMagickImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in… | Fix |
| CVE-2016-3718 | 5 May 2016 | CVSS 5.5 | ImageMagick Server-Side Request Forgery (SSRF)The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery… | ExploitedFix |
| CVE-2016-3718 | 5 May 2016 | CVSS 5.5 | ImageMagick Server-Side Request Forgery (SSRF)The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery… | ExploitedFix |
| CVE-2016-3715 | 5 May 2016 | CVSS 5.5 | ImageMagick Arbitrary File DeletionThe EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. | ExploitedFix |
| CVE-2016-3715 | 5 May 2016 | CVSS 5.5 | ImageMagick Arbitrary File DeletionThe EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. | ExploitedFix |
| CVE-2016-3714 | 5 May 2016 | CVSS 8.4 | ImageMagick Improper Input ValidationThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1… | ExploitedFix |
| CVE-2016-3714 | 5 May 2016 | CVSS 8.4 | ImageMagick Improper Input ValidationThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1… | ExploitedFix |