CVE-2026-23876High· 8.1▾ TwilightImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to w…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
0.6% → 0.7%
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue.
imagemagick < 6.9.13-38imagemagick >= 7.0.0-0, < 7.1.2-13Upgrade past the affected range:
imagemagick 7.1.2-13Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106574Medium· 5.3ImageMagick is free and open-source software used for editing and manipulating digital images
CVE-2026-106571Medium· 5.1ImageMagick is free and open-source software used for editing and manipulating digital images
CVE-2026-106564Medium· 5.3ImageMagick is free and open-source software used for editing and manipulating digital images
CVE-2025-68469Low· 3.3ImageMagick is free and open-source software used for editing and manipulating digital images
CVE-2026-105398Medium· 5.1Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105401Medium· 5.3Rejected reason: This CVE ID has been rejected as a duplicate.