ImageMagick before 7.1.2-31 Code Injection via PostScript Coders
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in its PostScript coders, because some values are not properly escaped or trimmed when written to output. Attackers can supply crafted values that embed arbitrary PostScript code into files generated by these coders.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-106577US | medium6.5 | — | ||
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into o… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105404.jsonADVISORY
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-105404ADVISORY
- https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-code-injection-via-postscript-codersADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan