CVE-2026-30936 ImageMagick has a heap Buffer Overflow in WaveletDenoiseImage

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a crafted image could cause an out of bounds heap write inside the WaveletDenoiseImage method. When processing a crafted image with the -wavelet-denoise operati...

CVE-2026-30936

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a crafted image could cause an out of bounds heap write inside the WaveletDenoiseImage method. When processing a crafted image with the -wavelet-denoise operati...

CVE-2026-30935

ImageMagick's CVE-2026-30935 describes a heap buffer over-read in BilateralBlurImage caused by an incorrect conversion when handling crafted images with -bilateral-blur. Affected versions are prior to 7.1.2-16; the issue can lead to an out-of-bounds read with local access and user interaction req...

CVE-2026-30929

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack. This vulnerability is fix...

CVE-2026-28493

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted image. This vulnerabili...

CVE-2026-28493 ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted image. This vulnerabili...

CVE-2026-28493

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted image. This vulnerabili...

PT-2026-23507

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.11.0 and 15.102.0 Description A flaw exists in Frappe that allows an attacker to inject malicious code through a crafted image URL. This can lead to Cross-Site Scripting XSS when a user’s avatar is displayed. The...

Frappe 跨站脚本漏洞

Frappe is a web development framework based on Python and Mariadb, with integrated front-end pages, developed by the Indian company Frappe. Versions of Frappe prior to 16.11.0 and 15.102.0 contained a cross-site scripting vulnerability. This vulnerability occurred due to the possibility of...

SUSE CVE-2026-25637

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never...

ImageMagick has a possible infinite loop in its JPEG encoder when using `jpeg:extent`

A continue statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang Denial of Service with a crafted image...

GHSA-GWR3-X37H-H84V ImageMagick has a possible infinite loop in its JPEG encoder when using `jpeg:extent`

A continue statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang Denial of Service with a crafted image...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the ClonePixelCacheRepository function. An attacker can cause a crash of the application by supplying a specially crafted image file. Remediation A fix was pushed into the master branch but not yet published...

NULL Pointer Dereference

Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

NULL Pointer Dereference

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

A NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in Denial of Service. AddressSanitizer:DEADLYSIGNAL =================================================================...

GHSA-GM37-QX7W-P258 ImageMagick: Possible memory leak in ASHLAR encoder

A memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. ==880062== Memcheck, a memory error detector ==880062== Copyright C 2002-2017, and GNU GPL'd, by Julian Seward et al...

CVE-2026-26983

A flaw was found in ImageMagick, a software suite for editing and manipulating digital images. A remote attacker could exploit this vulnerability by providing a specially crafted image containing an invalid element to the Magick Scripting Language MSL interpreter. This flaw causes a use-after-fre...

CVE-2026-26283

A flaw was found in ImageMagick. An attacker can exploit this vulnerability by providing a specially crafted image. This crafted image can trigger an infinite loop within the JPEG encoder, causing the software to consume 100% of the CPU and become unresponsive. This leads to a Denial of Service...

CVE-2026-25970

A flaw was found in ImageMagick. A remote attacker can exploit a signed integer overflow vulnerability in the SIXEL decoder by providing a maliciously crafted SIXEL image file. This vulnerability occurs during buffer reallocation operations and can lead to memory corruption and a denial of servic...