DeutschShown in its original language — a full translation is planned for a future version.
ImageMagick: Mehrere Schwachstellen
view advisory published 2026-09-27
Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
01
describes (33)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-109282US | low2.5 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpecte… | ||||
| CVE-2026-109281US | medium4.4 | — | ||
ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap… | ||||
| CVE-2026-109280US | low2.5 | — | ||
ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who… | ||||
| CVE-2026-109279US | low2.5 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple t… | ||||
| CVE-2026-109278US | low3.7 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource canno… | ||||
| CVE-2026-109277US | low3.3 | — | ||
ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operati… | ||||
| CVE-2026-109276US | medium5.3 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Atta… | ||||
| CVE-2026-109275US | medium4.8 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted M… | ||||
| CVE-2026-109274US | low2.5 | — | ||
ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script.… | ||||
| CVE-2026-109273US | medium5.3 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the d… | ||||
| CVE-2026-109272US | low3.7 | — | ||
ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted… | ||||
| CVE-2026-109271US | low3.7 | — | ||
ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can s… | ||||
| CVE-2026-109270US | low3.3 | — | ||
ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments.… | ||||
| CVE-2026-109269US | medium5.3 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory w… | ||||
| CVE-2026-109268US | low3.7 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can sup… | ||||
| CVE-2026-109267US | medium5.3 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can su… | ||||
| CVE-2026-109266US | medium5.3 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisc… | ||||
| CVE-2026-109265US | medium5.3 | — | ||
ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP… | ||||
| CVE-2026-109264US | low3.7 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name pro… | ||||
| CVE-2026-109263US | low3.7 | — | ||
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers c… | ||||
showing 20 of 33
02
references
External citations — patches, advisories, analysis.
- ImageMagick Releases vom 2026-09-27external
- GitHub Security Advisory GHSA-233r-2p53-wqf5 vom 2026-09-27external
- GitHub Security Advisory GHSA-2vwg-3g4g-qprm vom 2026-09-27external
- GitHub Security Advisory GHSA-3429-f84m-8qhw vom 2026-09-27external
- GitHub Security Advisory GHSA-462x-739v-qvq2 vom 2026-09-27external
- GitHub Security Advisory GHSA-54hm-vrmh-75qj vom 2026-09-27external
- GitHub Security Advisory GHSA-54rx-5x9g-g465 vom 2026-09-27external
- GitHub Security Advisory GHSA-58h4-rwr6-wj72 vom 2026-09-27external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan