Skip to content
OpenAdvisories
High USN-8263-1 15 CVEs

imagemagick vulnerabilities

Published May 11, 2026 · Updated Oct 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that ImageMagick incorrectly handled certain malformed
image files in certain instances. If a user or automated system using
ImageMagick were tricked into opening a specially crafted image, an
attacker could possibly use these issues to cause a denial of service or
possibly execute code. These issues only affected Ubuntu 14.04 LTS.
(CVE-2018-15607, CVE-2018-18544, CVE-2019-13137, CVE-2019-13391,
CVE-2019-13391)

It was discovered that ImageMagick incorrectly handled certain malformed
image files in certain instances. If a user or automated system using
ImageMagick were tricked into opening a specially crafted image, an
attacker could possibly use these issues to cause a denial of service or
possibly execute code. (CVE-2026-24481, CVE-2026-24484, CVE-2026-24485,
CVE-2026-25576, CVE-2026-25638, CVE-2026-25797, CVE-2026-25965)

It was discovered that ImageMagick incorrectly handled certain malformed
image files in certain instances. If a user or automated system using
ImageMagick were tricked into opening a specifically crafted image, an
attacker could possibly use these issues to cause a denial of service or
possibly execute code. These issues only affected Ubuntu 25.10.
(CVE-2026-25637, CVE-2026-25794, CVE-2026-25795, CVE-2026-25796,
CVE-2026-25797, CVE-2026-25798, CVE-2026-25799, CVE-2026-25897,
CVE-2026-25898)

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 25.10 imagemagick 8:7.1.2.3+dfsg1-1ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS imagemagick 8:6.7.7.10-6ubuntu3.13+esm21
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS imagemagick 8:6.8.9.9-7ubuntu5.16+esm20
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS imagemagick 8:6.9.7.4+dfsg-16ubuntu6.15+esm12
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS imagemagick 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm10
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS imagemagick 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9

Vulnerabilities 15

  • High 8.6
    CVE-2026-25965

    ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 8.2
    CVE-2026-25794

    ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensions

    ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multipli…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 7.5
    CVE-2026-24481

    ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 7.5
    CVE-2026-24485

    ImageMagick: Infinite loop vulnerability when parsing a PCD file

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 6.5
    CVE-2026-25897

    ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 6.5
    CVE-2026-25898

    Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an ar…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.7
    CVE-2026-25797

    ImageMagick vulnerable to Code injection via PostScript header in ps coders

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-24484

    ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 conta…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-25637

    ImageMagick: Possible memory leak in ASHLAR encoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-25638

    ImageMagick has memory leak in msl encoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But th…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-25795

    ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` m…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-25796

    ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resul…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-25798

    ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against I…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-25799

    ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.1
    CVE-2026-25576

    ImageMagick: Out of bounds read in multiple coders read raw pixel data

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processin…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet

References

  • report
    https://ubuntu.com/security/CVE-2026-24481
  • report
    https://ubuntu.com/security/CVE-2026-24484
  • report
    https://ubuntu.com/security/CVE-2026-24485
  • report
    https://ubuntu.com/security/CVE-2026-25576
  • report
    https://ubuntu.com/security/CVE-2026-25637
  • report
    https://ubuntu.com/security/CVE-2026-25638
  • report
    https://ubuntu.com/security/CVE-2026-25794
  • report
    https://ubuntu.com/security/CVE-2026-25795
  • report
    https://ubuntu.com/security/CVE-2026-25796
  • report
    https://ubuntu.com/security/CVE-2026-25797
  • report
    https://ubuntu.com/security/CVE-2026-25798
  • report
    https://ubuntu.com/security/CVE-2026-25799
  • report
    https://ubuntu.com/security/CVE-2026-25897
  • report
    https://ubuntu.com/security/CVE-2026-25898
  • report
    https://ubuntu.com/security/CVE-2026-25965