Skip to content
OpenAdvisories
Medium WID-SEC-2026-3486 26 CVEs

ImageMagick: Mehrere Schwachstellen

Published Sep 21, 2026 · Updated Oct 29, 2026 · Revision 9 · de-DE

Vendor: Debian Vendor: SUSE Product: Linux Product: Linux Product: openSUSE Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

Product

ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann.

Vulnerabilities 26

  • High 8.2
    CVE-2026-105405 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • High 8.2
    CVE-2026-105824 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 6.9
    CVE-2026-105399 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 6.9
    CVE-2026-105400 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 6.9
    CVE-2026-105402 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 6.9
    CVE-2026-105403 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 6.9
    CVE-2026-105825 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 6.9
    CVE-2026-105826 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 6.9
    CVE-2026-105827 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 6.2
    CVE-2026-106579

    ImageMagick: Policy Bypass when using coder as the domain.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by th…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 6.0
    CVE-2026-105401 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 6.0
    CVE-2026-105404 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 5.9
    CVE-2026-105398 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian
  • Medium 5.9
    CVE-2026-106578

    ImageMagick: Invalid Memory Free in MVG decoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.9
    CVE-2026-107209

    ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to f…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-106572

    ImageMagick: Stack Overflown CALS decoder due to missing depth check.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-106573

    ImageMagick: Denial of service in MVG decoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-106574

    ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crash

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap b…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-106575

    ImageMagick: Unclosed file pointer in magick script

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-106576

    ImageMagick: Denial of service possible when parsing an XMP profile.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of serv…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-106577

    ImageMagick: Code Injection in the postscript coders

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-107208

    ImageMagick: Denial of service with crafted XMP profile

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminatin…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-107210

    ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy li…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.1
    CVE-2026-106571

    ImageMagick: Heap Buffer Over-Write in GetVirtualPixels api will result in a crash

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 4.0
    CVE-2026-106580

    ImageMagick: Policy Bypass in CUT encoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny a…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 2.1
    CVE-2026-105823 Rejected

    This CVE ID has been rejected as a duplicate.

    imagemagick Debian

Revision history

  1. #9

    Neue Updates von Debian aufgenommen

  2. #8

    Neue Updates von openSUSE aufgenommen

  3. #7

    Neue Updates von Debian aufgenommen

  4. #6

    Neue Updates von SUSE aufgenommen

  5. #5

    Neue Updates von openSUSE und SUSE aufgenommen

  6. #4

    Neue Updates von SUSE aufgenommen

  7. #3

    Referenz(en) aufgenommen: CVE-2026-105827, EUVD-2026-95014, CVE-2026-105826, EUVD-2026-95013, CVE-2026-105404, EUVD-2026-95008, CVE-2026-105403, EUVD-2026-95007, CVE-2026-105825, EUVD-2026-95012, CVE-2026-105824, EUVD-2026-95011, CVE-2026-105405, EUVD-2026-95009, CVE-2026-105399, EUVD-2026-95003, CVE-2026-105400, EUVD-2026-95004, CVE-2026-105398, EUVD-2026-95002, CVE-2026-105401, EUVD-2026-95005, CVE-2026-105402, EUVD-2026-95006, CVE-2026-105823, EUVD-2026-95010

  8. #2

    Referenz(en) aufgenommen: CVE-2026-106573, EUVD-2026-94392, CVE-2026-107208, EUVD-2026-94409, CVE-2026-106571, EUVD-2026-94390, CVE-2026-106580, EUVD-2026-94408, CVE-2026-106577, EUVD-2026-94397, CVE-2026-107209, EUVD-2026-94410, CVE-2026-106579, EUVD-2026-94405, CVE-2026-107210, EUVD-2026-94411, CVE-2026-106578, EUVD-2026-94399, CVE-2026-106576, EUVD-2026-94396, CVE-2026-106575, EUVD-2026-94394, CVE-2026-106574, EUVD-2026-94393, CVE-2026-106572, EUVD-2026-94391

  9. #1

    Initiale Fassung

References