Imagemagick - vulnerabilities (CVEs)

900 CVEs in 3 products, 71 in the last 30 days, newest from 2026-10-25.

Products

Imagemagick - 898 CVEs
Graphicsmagick - 2 CVEs
Libmagick Library - 1 CVEs

Newest CVEs of Imagemagick

CVE-2026-116160 - CVSS 4.8 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images.…
CVE-2026-116159 - CVSS 4.8 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory…
CVE-2026-116158 - CVSS 2.5 (low), 2026-10-25: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers…
CVE-2026-116157 - CVSS 4.8 (medium), 2026-10-25: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can…
CVE-2026-116156 - CVSS 4.8 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who…
CVE-2026-116155 - CVSS 6.9 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images…
CVE-2026-116153 - CVSS 2.5 (low), 2026-10-25: ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull…
CVE-2026-116154 - CVSS 6.9 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing…
CVE-2026-116152 - CVSS 6.9 (medium), 2026-10-25: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers…
CVE-2026-116150 - CVSS 3.1 (low), 2026-10-25: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image.…
CVE-2026-116151 - CVSS 6.3 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a…
CVE-2026-116149 - CVSS 8.1 (high), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a…
CVE-2026-116147 - CVSS 6.3 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not…
CVE-2026-116148 - CVSS 4.8 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified…
CVE-2026-116146 - CVSS 6.3 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a…
CVE-2026-116144 - CVSS 4.8 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can…
CVE-2026-116145 - CVSS 3.9 (low), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in…
CVE-2026-116143 - CVSS 4.8 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length…
CVE-2026-116141 - CVSS 6.9 (medium), 2026-10-25: ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because…
CVE-2026-116142 - CVSS 4.8 (medium), 2026-10-25: ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a…
CVE-2026-116140 - CVSS 4.8 (medium), 2026-10-25: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still…
CVE-2026-109964 - CVSS 6.3 (medium), 2026-10-13: ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer…
CVE-2026-109282 - CVSS 2.5 (low), 2026-10-12: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a…
CVE-2026-109281 - CVSS 4.8 (medium), 2026-10-12: ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds…
CVE-2026-109280 - CVSS 2.5 (low), 2026-10-12: ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific…
CVE-2026-109279 - CVSS 2.5 (low), 2026-10-12: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of…
CVE-2026-109278 - CVSS 6.3 (medium), 2026-10-12: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a…
CVE-2026-109277 - CVSS 4.8 (medium), 2026-10-12: ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can…
CVE-2026-109276 - CVSS 6.9 (medium), 2026-10-12: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when…
CVE-2026-109275 - CVSS 6.3 (medium), 2026-10-12: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers…