CVE-2026-61862Low· 2.9▾ SunlitImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be prin…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 16 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the profile boundary). This behavior occurs when debug output is enabled.
ImageMagick >= 7.0.0 < 7.1.2-26ImageMagick < 6.9.13-51Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56378Low· 3.7ImageMagick - Heap Out-of-Bounds Read in PCD Decoder
CVE-2026-56362Low· 3.3ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization
CVE-2026-56361Low· 3.3ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing
CVE-2026-116142Low· 3.3ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box
CVE-2026-109281Medium· 4.4ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations
CVE-2026-109269Medium· 5.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input