171512 matches found
JLSEC-2026-895
In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This was fixed in upstream ImageMagick version 7.1.0-30...
JLSEC-2026-844
TIFFGetProfiles in /coders/tiff.c calls strstr which causes a large out-of-bounds read when it searches for "dc:format="image/dng" within profile due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to...
JLSEC-2026-934 ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails
ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will...
JLSEC-2026-927 ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
Summary CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but the fix is incomplete and ineffective. The latest version 7.1.2-5 remains vulnerable to the same integer overflow attack. The patch added BMPOverflowCheck but placed it after the overflow occurs, making it useless. A maliciou...
JLSEC-2026-939 ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch...
JLSEC-2026-953 ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access
ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd: pseudo-filenames e.g., fd:0, fd:1. Prior to version...
JLSEC-2026-968 ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD Photo CD files. The decoder contains an function that has an incorrect...
JLSEC-2026-966 ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with IPTCTEXT. Versions 7.1.2-15 and 6.9.13-40 contain a patch...
JLSEC-2026-967 ImageMagick has a possible infinite loop in its JPEG encoder when using `jpeg:extent`
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a continue statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger ...
JLSEC-2026-1007 ImageMagick: Policy Bypass in PSD decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would...
JLSEC-2026-853
in SetImageExtent of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. Th...
CVE-2026-17543
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
ROOT-APP-NPM-CVE-2026-48995 CVE-2026-48995 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-48995 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-FR4H-3CPH-29XV GHSA-fr4h-3cph-29xv in @rootio/pnpm - Patched by Root
Root has patched GHSA-fr4h-3cph-29xv in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-50017 CVE-2026-50017 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-50017 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-50021 CVE-2026-50021 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-50021 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-55487 CVE-2026-55487 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-55487 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-50015 CVE-2026-50015 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-50015 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...