Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-23952

ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dlemstra Imagemagick
Products
Magick.net Imagemagick
CVE-2026-24485

ImageMagick: Infinite loop vulnerability when parsing a PCD file

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Dlemstra Imagemagick
Products
Magick.net Imagemagick
CVE-2026-25576

ImageMagick: Out of bounds read in multiple coders read raw pixel data

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Dlemstra Imagemagick
Products
Magick.net Imagemagick
CVE-2026-24484

ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dlemstra Imagemagick
Products
Magick.net Imagemagick
CVE-2026-25637

ImageMagick: Possible memory leak in ASHLAR encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. Version 7.1.2-15 contains a patch.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dlemstra Imagemagick
Products
Magick.net Imagemagick
CVE-2026-27798

ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Dlemstra Imagemagick
Products
Magick.net Imagemagick
CVE-2026-27799

ImageMagick has a heap Buffer Over-read in its DJVU image format handler

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Dlemstra Imagemagick
Products
Magick.net Imagemagick