Skip to content
OpenAdvisories
High WID-SEC-2026-3867 14 CVEs

ImageMagick: Mehrere Schwachstellen

Published Oct 11, 2026 · Updated Nov 11, 2026 · Revision 9 · de

Vendor: amazon Vendor: Debian Vendor: gentoo Vendor: SUSE Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen, den Speicher zu beschädigen, Cross-Site-Scripting-Angriffe durchzuführen, einen Denial-of-Service-Angriff auszulösen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann.

Vulnerabilities 14

  • High 8.1
    CVE-2026-116149

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • High 7.0
    CVE-2026-108693

    ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate

    ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the workin…

    ImageMagick ImageMagick
  • Medium 5.6
    CVE-2026-109964

    ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder

    ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-116154

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak,…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Medium 5.3
    CVE-2026-116155

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhausti…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.7
    CVE-2026-116146

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.6
    CVE-2026-105081

    ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.6
    CVE-2026-116148

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing opti…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.3
    CVE-2026-116143

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMag…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.3
    CVE-2026-116144

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the proc…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.3
    CVE-2026-116159

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, r…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.3
    CVE-2026-116160

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites he…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.1
    CVE-2026-116150

    ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder

    ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Attackers can submit crafted images for FPX encoding to leak memory repeatedly, causing resource exhausti…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 2.5
    CVE-2026-116158

    ImageMagick before 7.1.2-33 Memory Leak in magick compare

    ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu

Revision history

  1. #9

    Neue Updates von Gentoo aufgenommen

  2. #8

    Neue Updates von SUSE und openSUSE aufgenommen

  3. #7

    Neue Updates von Debian und SUSE aufgenommen

  4. #6

    Neue Updates von openSUSE aufgenommen

  5. #5

    Neue Updates von Amazon, openSUSE und Debian aufgenommen

  6. #4

    CVE's ergänzt

  7. #3

    CVE-2026-109964 ergänzt

  8. #2

    CVE ergänzt

  9. #1

    Initiale Fassung

References