CVE-2026-61857Low· 3.7▾ SunlitImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.5%
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-66565Critical· 9.8Fiber Utils is a collection of common functions created for Fiber
GHSA-qh5g-q395-cx4jLow· 3.7ImageMagick: Heap-use-after-free via XMP profile could result in a crash
CVE-2026-118263MediumEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requests
GHSA-x9ff-22gv-65f4MediumEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requests
GHSA-9v8h-qqgm-4m35CriticalBrotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder