Skip to content
OpenAdvisories
High WID-SEC-2026-1567 15 CVEs

ImageMagick: Mehrere Schwachstellen

Published May 17, 2026 · Updated Nov 2, 2026 · Revision 21 · de-DE

Vendor: amazon Vendor: Debian Vendor: SUSE Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um einen Denial of Service Angriff durchzuführen oder Informationen offenzulegen.

Product

ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann.

Vulnerabilities 15

  • High 7.5
    CVE-2026-46520

    ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 7.5
    CVE-2026-46522 Public exploit

    ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versi…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 6.5
    CVE-2026-53466

    ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resul…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 6.2
    CVE-2026-46523

    ImageMagick: Use-After-Free in MSL decoder.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 6.2
    CVE-2026-46557

    ImageMagick: Stack overflow in fx operation

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-23, due to a missing depth check a stack overflow can occur in the fx operation by passing a crafted argument. This issue has been patched in…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.7
    CVE-2026-45359

    ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected compo…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-46521

    ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has be…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-45031

    ImageMagick: Policy Bypass in PSD decoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a P…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-45358

    ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. This issue h…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-45664

    ImageMagick: Policy Bypass in MNG coder could

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allo…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.1
    CVE-2026-42326

    ImageMagick: Heap Buffer Over-Read in IPTC encoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte. This issue has…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.1
    CVE-2026-45624

    ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific argument…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 4.0
    CVE-2026-46559

    ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. T…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 3.7
    CVE-2026-56369

    ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage

    ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.

    ImageMagick ImageMagick imagemagick magick.net-q8-anycpu Ubuntu NuGet
  • Low 3.3
    CVE-2026-56363

    ImageMagick - Division by Zero in Binomial Kernel Processing

    ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet

Revision history

  1. #21

    Neue Updates von openSUSE aufgenommen

  2. #20

    Neue Updates von SUSE aufgenommen

  3. #19

    Neue Updates von Amazon aufgenommen

  4. #18

    Neue Updates von SUSE aufgenommen

  5. #17

    Neue Updates von SUSE aufgenommen

  6. #16

    Neue Updates von SUSE und Debian aufgenommen

  7. #15

    Neue Updates von openSUSE aufgenommen

  8. #14

    Neue Updates von CVE und Debian aufgenommen

  9. #13

    Neue Updates von openSUSE aufgenommen

  10. #12

    Neue Updates von SUSE aufgenommen

  11. #11

    Referenz(en) aufgenommen: CVE-2026-56369, EUVD-2026-40449, CVE-2026-56363, EUVD-2026-40446

  12. #10

    Neue Updates von openSUSE aufgenommen

  13. #9

    Neue Updates von openSUSE aufgenommen

  14. #8

    Neue Updates von SUSE aufgenommen

  15. #7

    Neue Updates von SUSE aufgenommen

  16. #6

    Referenz(en) aufgenommen: EUVD-2026-36155, EUVD-2026-36164, EUVD-2026-36163, EUVD-2026-36162, EUVD-2026-36173, EUVD-2026-36172, EUVD-2026-36171, EUVD-2026-36161, EUVD-2026-36159, EUVD-2026-36158, EUVD-2026-36157, EUVD-2026-36160

  17. #5

    Neue Updates von Amazon aufgenommen

  18. #4

    Neue Updates von Debian aufgenommen

  19. #3

    Exploit für CVE-2026-46522 aufgenommen

  20. #2

    Neue Updates von Debian aufgenommen

  21. #1

    Initiale Fassung

References