Skip to content
OpenAdvisories
Medium WID-SEC-2026-2100 28 CVEs

ImageMagick: Mehrere Schwachstellen

Published Jun 28, 2026 · Updated Oct 20, 2026 · Revision 18 · de-DE

Vendor: amazon Vendor: Debian Vendor: SUSE Vendor: Ubuntu Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann.

Vulnerabilities 28

  • Medium 6.5
    CVE-2026-53466

    ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resul…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.9
    CVE-2026-55577

    ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted ima…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine
  • Medium 5.7
    CVE-2026-25797

    ImageMagick vulnerable to Code injection via PostScript header in ps coders

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-49219

    ImageMagick: Policy Bypass can read disallowed files

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-55510

    ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issu…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-55597

    ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-55628

    ImageMagick: Policy Bypass in concatenate operation due to missing checks

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-53467

    ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchange…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-55594

    ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 4.7
    CVE-2026-55595

    ImageMagick: Infinite Loop in connected-components when providing invalid arguments

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 3.7
    CVE-2026-61857

    ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP

    ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crash…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 3.7
    CVE-2026-61860

    ImageMagick before 7.1.2-26 Use-After-Free via freetype

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and ma…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 3.7
    CVE-2026-61861

    ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption

    ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling de…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 3.7
    CVE-2026-61868

    ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder

    ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet
  • Low 3.7
    CVE-2026-61871

    ImageMagick before 7.1.2-26 Memory Leak in ICON decoder

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet
  • Low 3.3
    CVE-2026-61465

    ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass

    ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the confi…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet
  • Low 3.3
    CVE-2026-61858

    ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder

    ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet
  • Low 3.3
    CVE-2026-61859

    ImageMagick before 7.1.2-26 Policy Bypass via script operation

    ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security poli…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 2.9
    CVE-2026-61862

    ImageMagick before 7.1.2-26 Information Disclosure via identify

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the pro…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 2.9
    CVE-2026-61863

    ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder

    ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 2.9
    CVE-2026-61864

    ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 2.9
    CVE-2026-61865

    ImageMagick before 7.1.2-26 Memory Leak in Hough Lines

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memory leak occurs.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet
  • Low 2.9
    CVE-2026-61866

    ImageMagick before 7.1.2-26 Memory Leak in JNG encoder

    ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG files that fail blob operations, causing resource exhaustion.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 2.9
    CVE-2026-61867

    ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder

    ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet
  • Low 2.9
    CVE-2026-61869

    ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 2.9
    CVE-2026-61870

    ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder

    ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Low 2.5
    CVE-2026-61872

    ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory c…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet
  • Low 1.8
    CVE-2026-61464

    ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet

Revision history

  1. #18

    Neue Updates von SUSE aufgenommen

  2. #17

    Neue Updates von Amazon und SUSE aufgenommen

  3. #16

    Neue Updates von Ubuntu aufgenommen

  4. #15

    Neue Updates von SUSE aufgenommen

  5. #14

    Neue Updates von Ubuntu aufgenommen

  6. #13

    Neue Updates von openSUSE und SUSE aufgenommen

  7. #12

    Neue Updates von SUSE aufgenommen

  8. #11

    Neue Updates von SUSE aufgenommen

  9. #10

    Neue Updates von openSUSE aufgenommen

  10. #9

    Neue Updates von openSUSE aufgenommen

  11. #8

    Neue Updates von SUSE aufgenommen

  12. #7

    Neue Updates von openSUSE aufgenommen

  13. #6

    Neue Updates von openSUSE und SUSE aufgenommen

  14. #5

    Neue Updates von SUSE aufgenommen, CVE Nummern ergänzt

  15. #4

    Neue Updates von SUSE und Debian aufgenommen

  16. #3

    Neue Updates von CVE, Open Source, openSUSE und European Union Vulnerability Database aufgenommen

  17. #2

    Referenz(en) aufgenommen: EUVD-2026-41112, EUVD-2026-41123, EUVD-2026-41122, EUVD-2026-41113, EUVD-2026-41121, EUVD-2026-41124, EUVD-2026-41120, EUVD-2026-41119

  18. #1

    Initiale Fassung

References