CVE-2026-116158

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service...

CVE-2026-116144

A flaw was found in ImageMagick. An attacker could cause a Denial of Service DoS by supplying a specially crafted Magick Vector Graphics MVG file. When processed, the file triggers uncontrolled recursion within the MVG decoder, exhausting stack memory and causing the application to crash...

CVE-2026-116148

A flaw was found in ImageMagick. The Magick Vector Graphics MVG encoder does not properly neutralize user-specified drawing options before writing them into generated output. An attacker capable of supplying drawing options can exploit this vulnerability to inject arbitrary drawing commands into...

CVE-2026-116146

A flaw was found in ImageMagick. The Magick Scripting Language MSL decoder fails to release allocated memory when processing specially crafted MSL files. An attacker could exploit this vulnerability by providing malicious MSL files for processing, resulting in excessive resource consumption and a...

EUVD-2026-109419

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service...

CVE-2026-116158 ImageMagick before 7.1.2-33 Memory Leak in magick compare

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service...

CVE-2026-116158

ImageMagick versions prior to 7.1.2-33 are vulnerable to a memory leak in the magick compare command. The root cause is a missing cleanup operation when a command fails, which allows an attacker to provide specific inputs that trigger repeated failed operations. This can lead to memory exhaustion...

PT-2026-122999

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service...

CVE-2026-111813

Apache Traffic Servers experimental magick plugin lets an unauthentic...

Linux Distros Unpatched Vulnerability : CVE-2026-111813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration...

DEBIAN-CVE-2026-111813

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

CVE-2026-111813

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

EUVD-2026-107489

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

CVE-2026-111813 Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

CVE-2026-111813

The Apache Traffic Server experimental magick plugin is vulnerable to argument injection (CWE-88). An unauthenticated client can control ImageMagick convert arguments because the plugin passes client query strings unfiltered in its default unsigned configuration. This issue affects versions 8.0.1...

CVE-2026-111813

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

PT-2026-120768

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.1 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description An unauthenticated client can control...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick within MagickCore/statistic.c. An attacker who submits a crafted file processed by ImageMagick could induce undefined behavior, resulting in an excessively large value for the 64-bit type ssizet. This likely leads to a disruption in the application’s...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who could connect to the magick-distribute-cache service could hijack a file descriptor in the server process when a race condition occurred. This...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a malicious MSL script could trigger a heap-use-after-free vulnerability. The operation element handler replaced and freed the image while the parser continued...