Summary
Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
Product
ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann.
Vulnerabilities 33
-
Medium 5.9
ImageMagick: Infinite Loop in bzip2 compressed images.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. …
-
Medium 5.9
ImageMagick: Infinite Loop in PSD decoder on 32-bit builds
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial…
-
Medium 5.3
ImageMagick: Heap Buffer Over-Write in EXR decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-3…
-
Medium 5.3
ImageMagick: Infinite Loop when reading a crafted XMP profile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from…
-
Medium 5.3
ImageMagick: Denial of service in ASE decoder because of missing security checks
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is f…
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the …
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder …
-
Medium 5.3
ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile
ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profi…
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted…
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is rea…
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for proces…
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a sing…
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary …
-
Medium 4.8
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path.
-
Medium 4.4
ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option
ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression p…
-
Medium 4.3
ImageMagick: Denial of service in distributed pixel cache server
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, ca…
-
Medium 4.0
ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file wi…
-
Low 3.7
ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder
ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap…
-
Low 3.7
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initializati…
-
Low 3.7
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail…
-
Low 3.7
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking me…
-
Low 3.7
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, ca…
-
Low 3.7
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, c…
-
Low 3.7
ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder
ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure condit…
-
Low 3.7
ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder
ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of se…
-
Low 3.7
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing unde…
-
Low 3.3
ImageMagick before 7.1.2-32 Memory Leak via -process Option
ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to …
-
Low 3.3
ImageMagick before 7.1.2-32 Policy Bypass via -script Operation
ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing…
-
Low 2.5
ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting…
-
Low 2.5
ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script
ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to re…
-
Low 2.5
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. An attack…
-
Low 2.5
ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option
ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed mem…
-
Low 2.5
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause …
Revision history
-
#12
Neue Updates von Debian aufgenommen
-
#11
Neue Updates von openSUSE aufgenommen
-
#10
Neue Updates von openSUSE und Debian aufgenommen
-
#9
Neue Updates von Debian aufgenommen
-
#8
Neue Updates von Debian aufgenommen
-
#7
Neue Updates von SUSE aufgenommen
-
#6
Neue Updates von openSUSE und SUSE aufgenommen
-
#5
Neue Updates von SUSE aufgenommen
-
#4
Referenz(en) aufgenommen: CVE-2026-109275, EUVD-2026-97719, CVE-2026-109273, EUVD-2026-97717, CVE-2026-109278, EUVD-2026-97580, CVE-2026-109272, EUVD-2026-97716, CVE-2026-109260, EUVD-2026-97704, CVE-2026-109267, EUVD-2026-97711, CVE-2026-109277, EUVD-2026-97579, CVE-2026-109271, EUVD-2026-97715, CVE-2026-109268, EUVD-2026-97712, CVE-2026-109269, EUVD-2026-97713, CVE-2026-109270, EUVD-2026-97714, CVE-2026-109266, EUVD-2026-97710, CVE-2026-109280, EUVD-2026-97582, CVE-2026-109282, EUVD-2026-97584, CVE-2026-109281, EUVD-2026-97583, CVE-2026-109279, EUVD-2026-97581, CVE-2026-109265, EUVD-2026-97709, CVE-2026-109264, EUVD-2026-97708, CVE-2026-109263, EUVD-2026-97707, CVE-2026-109259, EUVD-2026-97703, CVE-2026-109258, EUVD-2026-97702, CVE-2026-109262, EUVD-2026-97706, CVE-2026-109261, EUVD-2026-97705, CVE-2026-109276, EUVD-2026-97720, CVE-2026-109274, EUVD-2026-97718
-
#3
Referenz(en) aufgenommen: CVE-2026-106570, EUVD-2026-94389, CVE-2026-106567, EUVD-2026-94382, CVE-2026-106568, EUVD-2026-94387, CVE-2026-106569, EUVD-2026-94388, CVE-2026-106566, EUVD-2026-94381, CVE-2026-106565, EUVD-2026-94380, CVE-2026-106564, EUVD-2026-94379
-
#2
Referenz(en) aufgenommen: CVE-2026-102635, EUVD-2026-89030
-
#1
Initiale Fassung
References
-
ImageMagick Releases vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/releases
-
GitHub Security Advisory GHSA-233r-2p53-wqf5 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5
-
GitHub Security Advisory GHSA-2vwg-3g4g-qprm vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2vwg-3g4g-qprm
-
GitHub Security Advisory GHSA-3429-f84m-8qhw vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3429-f84m-8qhw
-
GitHub Security Advisory GHSA-462x-739v-qvq2 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2
-
GitHub Security Advisory GHSA-54hm-vrmh-75qj vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54hm-vrmh-75qj
-
GitHub Security Advisory GHSA-54rx-5x9g-g465 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465
-
GitHub Security Advisory GHSA-58h4-rwr6-wj72 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72
-
GitHub Security Advisory GHSA-5j8x-vq8c-vrp9 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5j8x-vq8c-vrp9
-
GitHub Security Advisory GHSA-69jx-j2x2-g5w4 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4
-
GitHub Security Advisory GHSA-7q74-r26w-fwcx vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7q74-r26w-fwcx
-
GitHub Security Advisory GHSA-8x3v-wr32-qqh4 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8x3v-wr32-qqh4
-
GitHub Security Advisory GHSA-8xmr-6q99-c4x8 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8xmr-6q99-c4x8
-
GitHub Security Advisory GHSA-9f9w-84g3-vp2c vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c
-
GitHub Security Advisory GHSA-9p7q-63hw-mcr4 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4
-
GitHub Security Advisory GHSA-cvgp-q487-j22w vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvgp-q487-j22w
-
GitHub Security Advisory GHSA-f32c-2v6j-wvh5 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f32c-2v6j-wvh5
-
GitHub Security Advisory GHSA-f983-243h-9x4r vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r
-
GitHub Security Advisory GHSA-g6p6-3ggg-3w7j vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j
-
GitHub Security Advisory GHSA-gwj6-pm7x-3r63 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63
-
GitHub Security Advisory GHSA-h499-883p-vph8 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h499-883p-vph8
-
GitHub Security Advisory GHSA-hvwf-wmm6-hvc3 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3
-
GitHub Security Advisory GHSA-j39j-wmxg-j8mv vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv
-
GitHub Security Advisory GHSA-jjp4-3fwf-393j vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jjp4-3fwf-393j
-
GitHub Security Advisory GHSA-jph3-37cg-79wg vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg
-
GitHub Security Advisory GHSA-m9c7-gf3j-hx6h vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h
-
GitHub Security Advisory GHSA-pmqj-84pr-qc7c vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c
-
GitHub Security Advisory GHSA-pv8x-gq6w-gp4r vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r
-
GitHub Security Advisory GHSA-rvv7-5mh8-vcfc vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc
-
GitHub Security Advisory GHSA-v2x3-wpmg-c4w6 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v2x3-wpmg-c4w6
-
GitHub Security Advisory GHSA-vv56-wmgw-m36w vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vv56-wmgw-m36w
-
GitHub Security Advisory GHSA-vxwm-jfjc-3r4x vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x
-
GitHub Security Advisory GHSA-w288-jj5x-hhvp vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp
-
GitHub Security Advisory GHSA-w68r-6fmr-cvg4 vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4
-
GitHub Security Advisory GHSA-xxrx-rjp3-27rj vom 2026-09-27
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxrx-rjp3-27rj
-
SUSE Security Update SUSE-SU-2026:4691-1 vom 2026-10-16
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029875.html
-
openSUSE Security Update OPENSUSE-SU-2026:12078-1 vom 2026-10-20
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4ULOGPZDUT2PENM2CTRS7G7BBSOCMVM/
-
SUSE Security Update SUSE-SU-2026:4753-1 vom 2026-10-20
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029914.html
-
SUSE Security Update SUSE-SU-2026:4799-1 vom 2026-10-21
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029984.html
-
Debian Security Advisory DLA-4858 vom 2026-10-26
https://lists.debian.org/debian-lts-announce/2026/10/msg00052.html
-
Debian Security Advisory DSA-6593 vom 2026-10-29
https://lists.debian.org/debian-security-announce/2026/msg00512.html
-
Debian Security Advisory DSA-6593 vom 2026-10-29
https://security-tracker.debian.org/tracker/DSA-6593-1
-
openSUSE Security Update OPENSUSE-SU-2026:12170-1 vom 2026-10-30
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/B3XPOUMEJDCSXCL7RKXKCZGHNZ5JBLIM/
-
Debian Security Advisory DLA-4875 vom 2026-11-01
https://lists.debian.org/debian-lts-announce/2026/10/msg00068.html
-
openSUSE Security Update OPENSUSE-SU-2026:12187-1 vom 2026-11-02
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NHN5ZUOMBTRSOYMOL65RW5LHRBGFGM6S/
-
Debian Security Advisory DSA-6611 vom 2026-11-04
https://lists.debian.org/debian-security-announce/2026/msg00530.html