CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...

CVE-2026-109964

Versions of ImageMagick before 7.1.2-33 and 6.9.13-58 are vulnerable to a heap buffer underwrite in the DecodeImage() function located in coders/pict.c . This issue specifically affects 32-bit builds and is caused by pointer arithmetic overflow . An attacker can provide a crafted PICT file with m...

CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...

CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...

EUVD-2026-98684

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...

CVE-2026-109279

A flaw was found in ImageMagick. Due to improper synchronization during concurrent security policy access, simultaneous reads and writes across multiple threads can trigger a race condition, leading to a heap buffer overwrite. An attacker capable of inducing concurrent security policy operations...

PT-2026-111559

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-33 ImageMagick versions prior to 6.9.13-58 Description A heap buffer underwrite occurs in 32-bit builds due to a pointer arithmetic overflow in the DecodeImage function within coders/pict.c. An attacker can...

AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791913022)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791913022 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and...

Rocky Linux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791913022)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791913022 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 a...

CVE-2026-109964: Buffer Underwrite

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...

CentOS Linux 8.5 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1791905425)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791905425 advisory. - A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage of...

CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791904140)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791904140 advisory. - A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage of...

CentOS Linux 8 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791903924)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791903924 advisory. - A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage of...

CVE-2026-59976

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-109282

A flaw was found in ImageMagick. A type confusion vulnerability exists in the INFO, JSON, and YAML encoders when writing images in a compressed format. An attacker who can induce the application to write an image using these encoders can trigger an unexpected process crash, leading to a Denial of...

CVE-2026-109280

A flaw was found in ImageMagick. A local attacker can cause a Denial of Service DoS or memory corruption by providing crafted -fx expressions under low-memory conditions. When a memory allocation fails during expression processing, the application accesses previously freed memory, leading to an...

CVE-2026-109278

A flaw was found in ImageMagick. This vulnerability allows an attacker to cause a Denial of Service DoS through memory exhaustion. The issue occurs during wavelet-denoise image processing, where the application fails to release allocated memory if a required resource cannot be acquired. By...

CVE-2026-109277

A flaw was found in ImageMagick. Missing checks in the -script operation allow an attacker to close file descriptors—handles used by the operating system to access open files or resources—that were not opened by the active task. This vulnerability allows an attacker to circumvent configured...

CVE-2026-109272

A flaw was found in ImageMagick. An attacker can trigger a NULL pointer dereference in the PostScript decoder by submitting a specially crafted PostScript file for processing when a policy limit is reached. This issue causes the application to crash, resulting in a Denial of Service DoS...

CVE-2026-109270

A flaw was found in ImageMagick. This vulnerability allows a local attacker to cause a Denial of Service DoS due to a memory leak in the -process command-line option. By repeatedly invoking this option with crafted arguments, allocated memory is not properly released, gradually exhausting system...