Total
849 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-86420 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service. | |||||
| CVE-2026-61870 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 2.9 LOW |
| ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service. | |||||
| CVE-2026-61863 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 2.9 LOW |
| ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak. | |||||
| CVE-2026-61861 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution. | |||||
| CVE-2026-61859 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy. | |||||
| CVE-2026-61858 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process. | |||||
| CVE-2026-61857 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes. | |||||
| CVE-2026-61465 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service. | |||||
| CVE-2026-56379 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 8.1 HIGH |
| ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering. | |||||
| CVE-2026-56378 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte. | |||||
| CVE-2026-56377 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries. | |||||
| CVE-2026-56376 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service. | |||||
| CVE-2026-56373 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory. | |||||
| CVE-2026-56371 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 5.3 MEDIUM |
| ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed. | |||||
| CVE-2026-56370 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution. | |||||
| CVE-2026-56369 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images. | |||||
| CVE-2026-56368 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service. | |||||
| CVE-2026-56366 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion. | |||||
| CVE-2026-56365 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service. | |||||
| CVE-2026-56363 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash. | |||||