ImageMagick vulnerabilities
CVEs whose affected-version data names the ImageMagick package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
93 CVEsRSS
CVE-2026-109266Medium· 5.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted fil…
CVE-2026-109265Medium· 5.3ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles
ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing…
CVE-2026-109264Low· 3.7ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that c…
CVE-2026-109263Low· 3.7ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder…
CVE-2026-109262Medium· 5.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are process…
CVE-2026-109261Low· 3.7ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion cause…
CVE-2026-109260Low· 3.7ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in whi…
CVE-2026-109259Medium· 5.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitia…
CVE-2026-109258Low· 2.5ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an i…
CVE-2026-105081Low· 3.6ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can crea…
CVE-2026-105402Medium· 5.3Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105401Medium· 5.3Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105399Medium· 5.3Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105398Medium· 5.1Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105404Medium· 5.3Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105403Medium· 6.2Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105400Medium· 5.3⚖ disputedRejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105826Medium· 5.3Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105823Medium· 4.0Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105405Medium· 5.9Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105827Medium· 5.3Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105825Medium· 5.3Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-105824Medium· 5.9Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-107210Medium· 5.3ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configu…
CVE-2026-107209Medium· 5.9ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause…
CVE-2026-107208Medium· 5.3ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary…
CVE-2026-106580Medium· 4.0ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data tha…
CVE-2026-106579Medium· 6.2ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing…
CVE-2026-106578Medium· 5.9ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixe…
CVE-2026-106577Medium· 5.3ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed…