Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the GIF encoding process when color quantization fails. An attacker can degrade system availability by repeatedly submitting specially crafted images that trigger memory allocation...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the PNG encoding process when libpng initialization fails. An attacker can exhaust system memory and cause a denial of service by repeatedly triggering failed PNG encoding operations...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the processing of XMP profiles. An attacker can cause the application to read beyond allocated memory and crash by supplying a crafted image containing a malformed XMP profile. Remediation A fix was pushed into the...

Incomplete Cleanup

Overview Affected versions of this package are vulnerable to Incomplete Cleanup via the JNG decoder process. An attacker can cause temporary files to accumulate by submitting specially crafted files for processing, leading to disk space exhaustion and degraded system availability. Remediation A f...

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release via the -script operation due to improper file descriptor handling. An attacker can circumvent configured security policies by closing file descriptors not opened by the current operation. Remediati...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the -process option. An attacker can cause unreleased memory allocations by repeatedly invoking the -process option with crafted arguments, leading to gradual memory exhaustion and...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the PDF writer process when handling CMYK images with JPEG2000 compression. An attacker can cause the reuse of freed memory by supplying a specially crafted CMYK image, potentially leading to a crash of the process...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the PostScript decoder when a policy limit is reached. An attacker can cause the application to crash by supplying a crafted PostScript file for processing. Remediation A fix was pushed into the master branc...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the PostScript decoder. An attacker can access sensitive memory contents by supplying a specially crafted PostScript file. Remediation A fix was pushed into the master branch but not yet published...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the WBINFO decoder when a memory allocation fails during image decoding. An attacker can cause the application to crash by supplying a specially crafted image that triggers reuse of freed memory. Remediation A fix was...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the JPEG decoding process. An attacker can access sensitive information by submitting a specially crafted JPEG file that causes the exposure of uninitialized memory contents during processing. Remediation A fix was...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the MVG decoder when a PostScript renderer is used. An attacker can execute arbitrary code by supplying a specially crafted MVG file th...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in the magick script. An attacker can access files protected by the path security policy by exploiting a time-of-check to time-of-use TOCTOU race condition, swapping a checked path with a symlink during script execution...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the wavelet-denoise process. An attacker can cause memory exhaustion and degrade service availability by repeatedly triggering this process under resource-constrained conditions...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the INFO, JSON, and YAML encoders when an internal method receives a pointer of an unexpected type during image writing in a compressed format. An attacker can cause the...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition through concurrent access to the security policy process. An attacker can cause the application to crash by triggering simultaneous reads and writes from multiple threads. Remediation A fix was pushed into the master bran...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the -fx option when a memory allocation fails during a specific operation. An attacker can cause application crashes or memory corruption by supplying crafted -fx expressions under memory pressure. Remediatio...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the -fx option processing. An attacker can access out-of-bounds heap memory by supplying a crafted -fx expression. Remediation A fix was pushed into the master branch but not yet published. References - GitHub...

CVE-2026-109269

A flaw was found in ImageMagick. An information disclosure vulnerability exists in the JPEG decoder when handling crafted input. A remote attacker could exploit this flaw by submitting a specially crafted JPEG file for processing, causing the application to read uninitialized memory and disclose...

CVE-2026-109265

A flaw was found in ImageMagick. A remote attacker can exploit this vulnerability to trigger an application crash, resulting in a Denial of Service DoS. The issue is caused by improper string termination in Extensible Metadata Platform XMP profiles, which leads to a heap buffer over-read when...