Filtered by vendor Imagemagick
Subscribe
Total
840 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-119124 | 1 Imagemagick | 1 Imagemagick | 2026-10-31 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application. | |||||
| CVE-2026-93589 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56. | |||||
| CVE-2026-93588 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.1 LOW |
| ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image. | |||||
| CVE-2026-93587 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56. | |||||
| CVE-2026-93586 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 2.9 LOW |
| ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions 7.1.2-31 and 6.9.13-56. | |||||
| CVE-2026-86425 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service). | |||||
| CVE-2026-86424 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 2.5 LOW |
| ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations. | |||||
| CVE-2026-86423 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service). | |||||
| CVE-2026-86422 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files. | |||||
| CVE-2026-86421 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service. | |||||
| CVE-2026-86420 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service. | |||||
| CVE-2026-61870 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 2.9 LOW |
| ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service. | |||||
| CVE-2026-61863 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 2.9 LOW |
| ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak. | |||||
| CVE-2026-61861 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution. | |||||
| CVE-2026-61859 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy. | |||||
| CVE-2026-61858 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process. | |||||
| CVE-2026-61857 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes. | |||||
| CVE-2026-61465 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service. | |||||
| CVE-2026-56379 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 8.1 HIGH |
| ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering. | |||||
| CVE-2026-56378 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | N/A | 3.7 LOW |
| ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte. | |||||