Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 915

Export CSV
CVE-2026-106575

ImageMagick: Unclosed file pointer in magick script

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-106576

ImageMagick: Denial of service possible when parsing an XMP profile.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-106577

ImageMagick: Code Injection in the postscript coders

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-106578

ImageMagick: Invalid Memory Free in MVG decoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-106579

ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-106580

ImageMagick: Policy Bypass in CUT encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-107208

ImageMagick: Denial of service with crafted XMP profile

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-107209

ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-107210

ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109281

ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option

ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109276

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109271

ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder

ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109261

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109282

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109277

ImageMagick before 7.1.2-32 Policy Bypass via -script Operation

ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109272

ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder

ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109267

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109262

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109964

ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-109280

ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option

ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick