Missing Release of File Descriptor or Handle after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of File Descriptor or Handle after Effective Lifetime in the magick script. An attacker can cause resource exhaustion by repeatedly processing crafted scripts that leave file pointers unclosed, eventually exhausting...

Free of Memory not on the Heap

Overview Affected versions of this package are vulnerable to Free of Memory not on the Heap through the MVG decoder process. An attacker can cause a crash of the process by submitting a specially crafted image file. Remediation A fix was pushed into the master branch but not yet published...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via repeated connections to the distributed pixel cache server. An attacker can exhaust available connections by continuously initiating new connections from an adjacent network, resulting in service disruption...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the XMP profile parser. An attacker can cause excessive resource consumption by submitting a specially crafted XMP profile that triggers intensive processing when determining rational values. Details Denial of...

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Authorization Before Parsing and Canonicalization via the coder process. An attacker can access data that should be restricted by supplying a specially crafted image file. Remediation A fix was pushed into the...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to a missing security-policy check in the CUT encoder. An attacker can read data that should be denied by policy and cause a crash by performing a crafted local encoding operation. Remediation A fix was pushed...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the processing of a crafted XMP profile. An attacker can cause the image-processing process to terminate unexpectedly by supplying a specially crafted input that triggers a recursion limit to be handled as ...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the RSVG decoder when built without cairo support. An attacker can cause a crash by submitting a specially crafted RSVG image that triggers a resource limit, leading to double-free and use of freed memory. Remediation A f...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the MAT decoder when processing highly compressed data. An attacker can cause excessive disk space consumption by bypassing configured resource restrictions via...

Unsigned to Signed Conversion Error

Overview Affected versions of this package are vulnerable to Unsigned to Signed Conversion Error through the PSD decoder process on 32-bit builds. An attacker can cause the application to enter an infinite loop and exhaust system resources by submitting a specially crafted PSD file. Remediation A...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the ASE decoder due to missing validation and resource checks. An attacker can cause a crash or significantly degrade service availability by submitting a specially crafted AS...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the postscript process. An attacker can execute arbitrary code by providing specially crafted input that is not properly escaped or trimmed. Remediation A fix was pushed into the master branch but not yet...

Arbitrary Code Injection

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the CALS decoder process. An attacker can cause the application to exhaust the call stack and terminate unexpectedly by submitting a specially crafted CALS image file. Remediation A fix was pushed into the...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the distributed pixel cache server process. An attacker can cause the server to crash by sending specially crafted pixel data that triggers an integer-size calculation error and overwrites the heap buffer...

DEBIAN-CVE-2026-107210

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions a...

CVE-2026-107210

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions a...

DEBIAN-CVE-2026-107208

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This...

DEBIAN-CVE-2026-107209

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use fre...

CVE-2026-107208

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This...