CVE-2026-33535

ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, an out-of-bounds write of a zero byte exists in the X11 `display` interaction path that could lead to a crash. Versions 7.1.2-18 and 6.9.13-43 patch the issue.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-33536

ImageMagick has an Out-of-bounds Write via InterpretImageFilename

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, due to an incorrect return value on certain platforms a pointer is incremented past the end of a buffer that is on the stack and that could result in an out of bounds write. Versions 7.1.2-18 and 6.9.13-43 patch the issue.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-32636

ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-32259

ImageMagick has a possible stack buffer overflow in sixel encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, when a memory allocation fails in the sixel encoder it would be possible to write past the end of a buffer on the stack. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-31853

ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, an overflow on 32-bit systems can cause a crash in the SFW decoder when processing extremely large images. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2022-2719

ImageMagick: Assertion Failure could lead to DoS due to attempted writing of NULL image list

In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This was fixed in upstream ImageMagick version 7.1.0-30.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Imagemagick

Products

Extra Packages For Enterprise Linux Fedora Imagemagick

CVE-2023-34153

ImageMagick: Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding

A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.

CVSS 3.1 · 7.8 High EPSS 3.1% KEV · Not listed

Vendors

Fedoraproject Imagemagick Redhat

Products

Extra Packages For Enterprise Linux Fedora Imagemagick and 1 more

CVE-2025-57803

ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2021-3610

ImageMagick: heap-based buffer overflow in ReadTIFFImage() in coders/tiff.c

A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed

Vendors

Fedoraproject Imagemagick Redhat

Products

Fedora Imagemagick Enterprise Linux

CVE-2025-65955

ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2025-66628

ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2025-68618

Magick's failure to limit the depth of SVG file reads caused a DoS attack.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2025-68950

Magick's failure to limit MVG mutual references forming a loop

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2025-69204

ImageMagick converting a malicious MVG file to SVG caused an integer overflow.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2025-43965

ImageMagick: Incorrect Handling of Image Depth in MIFF Processing in ImageMagick

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed

Vendors

Debian Imagemagick

Products

Debian Linux Imagemagick

CVE-2025-46393

ImageMagick: Incorrect Calculation of Buffer Size in ImageMagick's Multispectral MIFF Processing

In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2025-68469

ImageMagick vulnerable to heap-buffer-overflow

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.1-14, ImageMagick crashes when processing a crafted TIFF file. Version 7.1.1-14 fixes the issue.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2024-41817

Arbitrary Code Execution in `AppImage` version `ImageMagick`

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The vulnerability is fixed in 7.11-36.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Imagemagick Linux

Products

Imagemagick Linux Kernel

CVE-2022-48541

ImageMagick: memory leak in identify -help

A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command.

CVSS 3.1 · 7.1 High EPSS 1.5% KEV · Not listed

Vendors

Fedoraproject Imagemagick

Products

Fedora Imagemagick

CVE-2025-62594

ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick