CVE-2026-105404

A flaw was found in ImageMagick. This vulnerability allows a remote attacker to achieve arbitrary code execution or unauthorized data access by supplying crafted input values to the PostScript a page description language coders. Because the application fails to properly sanitize and escape values...

CVE-2026-105403

A flaw was found in ImageMagick. An attacker can bypass security policy restrictions by providing a crafted image when policies are configured using the coder domain rather than the module domain. Successful exploitation causes the application to process image formats that administrators intended...

CVE-2026-105399

A flaw was found in ImageMagick. A remote attacker could exploit this issue by submitting a specially crafted Magick Vector Graphics MVG image that triggers a long-running decoding operation due to a missing limit check in the MVG decoder. This can consume excessive processor resources and stall...

CVE-2026-105402

A flaw was found in ImageMagick. A remote attacker could cause a Denial of Service DoS by submitting an image containing a crafted Extensible Metadata Platform XMP profile. When parsing the malicious metadata, an error during numeric value calculation causes the application to hang or crash,...

CVE-2026-105398

A flaw was found in ImageMagick. An attacker can exploit a heap buffer overflow vulnerability by supplying crafted input during calls to the GetVirtualPixels application programming interface API. This issue allows the attacker to overwrite heap memory, leading to an application crash and resulti...

SUSE CVE-2026-106564

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32...

SUSE CVE-2026-106565

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-...

SUSE CVE-2026-106566

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in...

SUSE CVE-2026-106567

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in...

SUSE CVE-2026-106568

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in...

SUSE CVE-2026-106570

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...

SUSE CVE-2026-106571

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. This issue is fixe...

SUSE CVE-2026-106572

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions...

SUSE CVE-2026-106573

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and...

SUSE CVE-2026-106574

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...

SUSE CVE-2026-106575

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...

SUSE CVE-2026-106576

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version...

SUSE CVE-2026-106577

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56...

SUSE CVE-2026-106578

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56...

SUSE CVE-2026-106579

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...