PT-2026-110695

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description A memory leak exists in the wavelet-denoise operation, which occurs when the software fails to release allocated memory after failing to acquire a...

CVE-2026-109262: Missing Release of Memory after Effective Lifetime

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder WriteSVGImage that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of...

CVE-2026-109263: Missing Release of Memory after Effective Lifetime

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting...

PT-2026-110682

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.1.1-7 through 7.1.2-31 Description A heap buffer over-read occurs due to incorrect string termination in XMP profiles, which are metadata formats used to describe the creation and history of a digital asset. An attacker...

PT-2026-110693

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description An incomplete cleanup flaw exists in the JNG decoder. When processing specially crafted JNG files, the software fails to remove temporary files. This ca...

CVE-2026-109269: Out-of-bounds Read

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory...

PT-2026-110675

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.1.0-20 through 7.1.2-31 Description An invalid memory free occurs during the fx operation when the initialization of an FX runtime entry fails. This can be triggered by an attacker to cause memory corruption and...

PT-2026-110685

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description A use after free issue exists in the PDF writer when processing CMYK images using JPEG2000 compression. A use after free occurs when a program continues...

PT-2026-110686

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description The JPEG decoder contains an issue that allows for information disclosure. When processing a specially crafted JPEG file, the decoder performs a read...

CVE-2026-109260: Missing Release of Memory after Effective Lifetime

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause ...

CVE-2026-109276: Incomplete Cleanup

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and...

PT-2026-110678

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description A memory leak exists in the GIF encoder. This occurs because allocated memory is not released when color quantization—the process of reducing the number...

CVE-2026-109275: Improper Neutralization of Special Elements in Output Used by a Downstream Component

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path...

Uncontrolled Search Path Element

Overview Affected versions of this package are vulnerable to Uncontrolled Search Path Element in the NTGhostscriptEXE process. An attacker can execute arbitrary code by placing a malicious gswin64c.exe in the working directory and triggering the conversion of PDF, PostScript, or EPS files...

CVE-2026-108693

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with...

CVE-2026-108693

A flaw was found in ImageMagick. An insecure search path vulnerability allows a local attacker to achieve arbitrary code execution by placing a malicious executable into the application's working directory. When converting document formats such as PDF or PostScript on Windows systems without a...

CVE-2026-108693 ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with...

CVE-2026-108693

The ImageMagick software on Windows versions through 7.1.2-33 and 6.9.13-58 is vulnerable to an uncontrolled search path vulnerability within the NTGhostscriptEXE() function. When Ghostscript is unregistered, the application launches gswin64c.exe using its bare name. This allows an attacker to pl...

EUVD-2026-96696

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with...

CVE-2026-108693 ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with...