CVE-2026-55628 ImageMagick: Policy Bypass in concatenate operation due to missing checks

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been...

CVE-2026-55628 ImageMagick: Policy Bypass in concatenate operation due to missing checks

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been...

CVE-2026-56377

A flaw in ImageMagick’s policy enforcement allows remote attackers to bypass path restrictions within sandboxed conversion services. By circumventing these controls, an attacker can create or truncate files outside permitted security boundaries, leading to unauthorized file manipulation. Mitigati...

CVE-2026-56365

A flaw was found in ImageMagick. A remote attacker could exploit a memory leak vulnerability in the Portable Network Graphics PNG encoder when it fails to write Multiple-image Network Graphics MNG images. This flaw allows attackers to exhaust memory resources, leading to a denial of service DoS...

ROOT-OS-DEBIAN-12-CVE-2026-53461 CVE-2026-53461 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-53461 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-46520 CVE-2026-46520 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-46520 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-46522 CVE-2026-46522 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-46522 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-49218 CVE-2026-49218 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-49218 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-53460 CVE-2026-53460 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-53460 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

EUVD-2026-40446

ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash...

EUVD-2026-40450

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries...

EUVD-2026-40448

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service...

EUVD-2026-40449

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images...

openSUSE 16: ImageMagick / ImageMagick-config-7-SUSE / etc (openSUSE-SU-2026:21071-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21071-1 advisory. This update for ImageMagick fixes the following issues Security issues: - CVE-2026-42050: Stack buffer overflow in XTileImage bsc1265048. -...

Linux Distros Unpatched Vulnerability : CVE-2026-56361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-56377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attacke...

PT-2026-54855

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-51 ImageMagick versions prior to 7.1.2-26 Description An infinite loop occurs when invalid arguments are provided to the connected-components option. Recommendations Update to version 6.9.13-51. Update to...

PT-2026-54825

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-51 ImageMagick versions prior to 7.1.2-26 Description An integer overflow in the XCF decoder can lead to an out-of-bounds read when processing a specially crafted image, which may cause the application to...

Linux Distros Unpatched Vulnerability : CVE-2026-56363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacke...

PT-2026-54852

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-51 ImageMagick versions prior to 7.1.2-26 Description A use-after-free occurs when identifying an image containing a crafted 8BIM profile with a specific format string. Use-after-free is a memory corruption...