CVE-2026-105399 ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image...

EUVD-2026-95003

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image...

CVE-2026-105399

The ImageMagick software is vulnerable to a Denial of Service (DoS) attack in the MVG decoder due to a missing limit check . A remote attacker can submit a specially crafted Magick Vector Graphics (MVG) image to trigger a long-running decoding operation, consuming excessive processor resources an...

CVE-2026-105399

Removed by vendor...

CVE-2026-105398

...

CVE-2026-105398 ImageMagick before 7.1.2-31 Heap Buffer Overflow via GetVirtualPixels API

ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service...

CVE-2026-105398

ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service...

CVE-2026-105398

...

CVE-2026-105398

A heap buffer overflow vulnerability exists in ImageMagick versions prior to 6.9.13-56 and 7.1.2-31 . An attacker can exploit this flaw by providing crafted input during calls to the GetVirtualPixels API, triggering an integer calculation error that leads to an out-of-bounds heap write. This can ...

EUVD-2026-95002

ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service...

CVE-2026-105398

Removed by vendor...

CVE-2026-107639: Improper Neutralization of Argument Delimiters in a Command

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd does no...

PT-2026-107986

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-30 ImageMagick versions prior to 6.9.13-55 Description The CALS decoder contains an uncontrolled recursion issue caused by a missing depth check. A remote attacker can provide a specially crafted CALS image ...

PT-2026-107978

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A denial of service issue exists where attackers can disrupt image processing by supplying a crafted XMP profile. An XMP profile is a metadata standard used to store information about an image...

PT-2026-107975

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-56 ImageMagick versions prior to 7.1.2-31 Description A denial of service issue exists in the MVG decoder due to a missing limit check. An attacker can provide a specially crafted MVG image that triggers a...

PT-2026-107998

Name of the Vulnerable Software and Affected Versions ILIAS versions prior to 9.24 ILIAS versions 10.x prior to 10.12 ILIAS versions 11.x prior to 11.5 Description An argument injection issue exists in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options throu...

PT-2026-107985

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-55 ImageMagick versions prior to 7.1.2-30 Description A security policy bypass exists in the MAT decoder. The issue occurs because the decoder fails to enforce configured temporary file size limits when...

PT-2026-107981

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-56 ImageMagick versions prior to 7.1.2-31 Description The MVG decoder contains an invalid memory free issue. An attacker can provide a specially crafted MVG image for processing to trigger this invalid free...

PT-2026-107976

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A resource leak occurs when the software processes a crafted magick script, allowing attackers to leave file pointers open. This leads to the leakage of file descriptors, which can exhaust...

PT-2026-107980

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-56 ImageMagick versions prior to 7.1.2-31 Description Code injection is possible in the PostScript coders because certain values are not properly escaped or trimmed during output. This allows attackers to...