PT-2026-107980

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-56 ImageMagick versions prior to 7.1.2-31 Description Code injection is possible in the PostScript coders because certain values are not properly escaped or trimmed during output. This allows attackers to...

PT-2026-107977

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A heap buffer overflow exists in the distributed pixel cache server. This occurs when connecting clients send crafted data, allowing them to overwrite heap memory. An attacker can exploit this...

PT-2026-107974

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A heap buffer overflow occurs when a crafted call is made to the 'GetVirtualPixels' API. This allows attackers to overwrite heap memory through crafted input, which can lead to a server crash...

PT-2026-107979

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-56 ImageMagick versions prior to 7.1.2-31 Description A security policy bypass occurs when a policy uses coder instead of module as its domain. This allows an attacker to provide a crafted image to evade...

PT-2026-107982

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-56 ImageMagick versions prior to 7.1.2-31 Description The CUT encoder lacks a security policy check, which allows configured security policies to be bypassed. An attacker can provide specially crafted input...

OPENSUSE-SU-2026:12078-1 ImageMagick-7.1.2.32-1.1 on GA media

These are all security issues fixed in the ImageMagick-7.1.2.32-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-107984

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-55 ImageMagick versions prior to 7.1.2-30 Description A denial of service issue exists in the handling of XMP profiles Extensible Metadata Platform, a standard for creating, transferring, and exchanging...

PT-2026-107983

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-55 ImageMagick versions prior to 7.1.2-30 Description A use-after-free issue exists in the RSVG decoder when the software is built without cairo support. A use-after-free occurs when a program continues to...

CVE-2026-107210

A flaw was found in ImageMagick. A remote attacker could exploit this vulnerability by submitting a specially crafted, highly compressed MATLAB MAT image file for processing. When decompressing the file, the decoder creates temporary files exceeding configured security policy limits, bypassing...

CVE-2026-107209

A flaw was found in ImageMagick. When ImageMagick is built without Cairo graphics support, processing a specially crafted vector image that hits a resource limit can cause the RSVG decoder to release memory twice and reference freed memory. A remote attacker could exploit this issue by supplying ...

CVE-2026-107208

A flaw was found in ImageMagick. When processing a specially crafted Extensible Metadata Platform XMP profile, the software triggers an internal recursion limit that is handled as a fatal condition rather than a standard exception. A remote attacker can exploit this vulnerability by submitting a...

CVE-2026-106580

A flaw was found in ImageMagick. A missing security policy check in the CUT encoder allows a local attacker to execute a crafted encoding operation that bypasses established restrictions. Successful exploitation can lead to unauthorized data reading information disclosure or cause the application...

CVE-2026-106579

A flaw was found in ImageMagick. This issue allows an attacker to bypass access controls and read restricted files, leading to unauthorized information disclosure. By supplying a specially crafted image to a system configured with security policies that restrict image decoders the coder domain, t...

CVE-2026-106578

A flaw was found in ImageMagick. This vulnerability can lead to a Denial of Service DoS when the software processes untrusted input. A remote attacker could submit a specially crafted image file that triggers an invalid memory free condition in the Magick Vector Graphics MVG decoder, causing the...

CVE-2026-106577

A flaw was found in ImageMagick. Due to improper input sanitization, unescaped or untrimmed values can result in code injection within output generated by PostScript coders. A remote attacker could supply specially crafted input to embed arbitrary code into the generated PostScript documents. Whe...

CVE-2026-106576

A flaw was found in ImageMagick. A remote attacker can cause a Denial of Service DoS by submitting an image containing a specially crafted Extensible Metadata Platform XMP profile. When ImageMagick processes the profile, calculating the numerator and denominator of a rational value triggers...

CVE-2026-106575

A flaw was found in ImageMagick. An attacker could provide a specially crafted Magick script that fails to release opened file pointers during execution. Repeated processing of such scripts can exhaust available file descriptors system resources used to manage open files, resulting in a Denial of...

CVE-2026-106574

A flaw was found in ImageMagick. An attacker connected to the distributed pixel cache server can send crafted pixel data that triggers an integer calculation error, leading to a heap buffer overwrite. This issue causes the server to crash, resulting in a Denial of Service DoS...

CVE-2026-106573

A flaw was found in ImageMagick. A missing limit check in the Magick Vector Graphics MVG decoder allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted image file. Processing this malicious input triggers an excessively long-running operation that exhausts syst...

CVE-2026-106572

A flaw was found in ImageMagick. A remote attacker can trigger a Denial of Service DoS by submitting a specially crafted Continuous Acquisition and Life-cycle Support CALS raster image for processing. Due to a missing recursion depth limit in the CALS decoder, parsing the malicious file exhausts...