Skip to content
OpenAdvisories
Medium WID-SEC-2026-1760 8 CVEs

ImageMagick: Mehrere Schwachstellen

Published May 31, 2026 · Updated Sep 28, 2026 · Revision 17 · de-DE

Vendor: amazon Vendor: Debian Vendor: SUSE Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um einen Denial of Service Zustand herbeizuführen, um Informationen offenzulegen und um Sicherheitsmechanismen zu umgehen.

Product

ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann.

Vulnerabilities 8

  • High 7.5
    CVE-2026-49218

    ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 6.5
    CVE-2026-53466

    ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resul…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.9
    CVE-2026-48994

    ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-48724

    ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-24, when using an image with mask the Floyd-Steinberg dithering method it will cause a negative heap buffer over-write. This issue has been p…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-48734

    ImageMagick: Stack Overflow in MVG decoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. This issue has been patch…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-49219

    ImageMagick: Policy Bypass can read disallowed files

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 4.7
    CVE-2026-48733

    ImageMagick: Infinite Loop in subimage-search with crafted image

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in the subimage-search operation can happen when using a crafted image. This issue has been patched in ve…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 3.3
    CVE-2026-56377

    ImageMagick - Policy Bypass via Incorrect Path Validation

    ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files ou…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu

Revision history

  1. #17

    Neue Updates von Amazon aufgenommen

  2. #16

    Neue Updates von SUSE aufgenommen

  3. #15

    Neue Updates von openSUSE aufgenommen

  4. #14

    Neue Updates von SUSE aufgenommen

  5. #13

    Neue Updates von SUSE aufgenommen

  6. #12

    Neue Updates von SUSE aufgenommen

  7. #11

    Neue Updates von SUSE und Debian aufgenommen

  8. #10

    Neue Updates von openSUSE aufgenommen

  9. #9

    Neue Updates von CVE und Debian aufgenommen

  10. #8

    Neue Updates von SUSE aufgenommen

  11. #7

    Referenz(en) aufgenommen: CVE-2026-56377, EUVD-2026-40450

  12. #6

    Neue Updates von openSUSE aufgenommen

  13. #5

    Neue Updates von Debian und SUSE aufgenommen

  14. #4

    Neue Updates von Amazon aufgenommen

  15. #3

    Neue Updates von Debian aufgenommen

  16. #2

    Referenz(en) aufgenommen: EUVD-2026-36180, EUVD-2026-36179, EUVD-2026-36185, EUVD-2026-36184, EUVD-2026-36183, EUVD-2026-36182

  17. #1

    Initiale Fassung

References