DeutschShown in its original language — a full translation is planned for a future version.
ImageMagick: Mehrere Schwachstellen
view advisory published 2026-06-28
Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
01
describes (28)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-61872US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters c… | ||||
| CVE-2026-61871US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an all… | ||||
| CVE-2026-61869US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to deni… | ||||
| CVE-2026-61868US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resourc… | ||||
| CVE-2026-61867US | — | — | ||
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image proce… | ||||
| CVE-2026-61866US | high7.5 | — | ||
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG f… | ||||
| CVE-2026-61865US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memory leak occurs. | ||||
| CVE-2026-61864US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released. | ||||
| CVE-2026-61863US | high7.5 | — | ||
ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory l… | ||||
| CVE-2026-61862US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not print… | ||||
| CVE-2026-61860US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memo… | ||||
| CVE-2026-61859US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading… | ||||
| CVE-2026-61464US | — | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result… | ||||
| CVE-2026-61870US | high7.5 | — | ||
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially… | ||||
| CVE-2026-61861US | high7.5 | — | ||
ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures… | ||||
| CVE-2026-61858US | medium5.3OT elevated | — | ||
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallo… | ||||
| CVE-2026-61857US | high7.5 | — | ||
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with spec… | ||||
| CVE-2026-61465US | medium6.5 | — | ||
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted im… | ||||
| CVE-2026-55628US | —OT elevated | — | ||
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy check… | ||||
| CVE-2026-55597US | — | — | ||
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer… | ||||
showing 20 of 28
02
references
External citations — patches, advisories, analysis.
- Amazon Linux Security Advisory ALAS2-2026-3939 vom 2026-09-29external
- GitHub Security Advisory GHSA-56m6-8q75-f2rw vom 2026-06-28external
- GitHub Security Advisory GHSA-6jwg-7q3p-5fqm vom 2026-06-28external
- GitHub Security Advisory GHSA-6vxp-gfwf-hcr9 vom 2026-06-28external
- GitHub Security Advisory GHSA-7c7m-fpjw-gwcq vom 2026-06-28external
- GitHub Security Advisory GHSA-82mp-vp5c-9pf7 vom 2026-06-28external
- GitHub Security Advisory GHSA-8g53-9m3c-69xg vom 2026-06-28external
- GitHub Security Advisory GHSA-99w9-hv66-rfv7 vom 2026-06-28external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan