Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

Magick.NET-Q16-AnyCPU

161 known vulnerabilities (1 critical, 27 high, 116 medium, 16 low), with the versions each affects and the releases that fix them.

Latest release
15.1.0 (Nov 5, 2026): no advisory affects it
Newest unaffected release
15.1.0 (Nov 5, 2026), the latest release
Advisories
161 · 1 critical, 27 high, 116 medium, 16 low
Releases
224 since 6.8.8.1001 (Apr 10, 2014)
Registry
NuGet
Releases read
Nov 8, 2026

Version timeline

Show all 161 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 161

  • CVE-2026-62946Medium 5.1

    ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 18 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-62363Medium 5.0

    ImageMagick: Heap Buffer Over-Write in fx operation

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 18 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-62343Medium 4.7

    ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 17 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-66011Medium 4.8

    ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 13 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-61871Medium 6.3

    ImageMagick before 7.1.2-26 Memory Leak in ICON decoder

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-61868Medium 6.3

    ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Memory Leak in JNG encoder

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Memory Leak in Hough Lines

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Information Disclosure via identify

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-61860Medium 6.3

    ImageMagick before 7.1.2-26 Use-After-Free via freetype

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

Show all 161 advisoriesShow fewer advisories
  • CVE-2026-61859Medium 4.8

    ImageMagick before 7.1.2-26 Policy Bypass via script operation

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56375Medium 4.8

    ImageMagick - Memory Leak in ASHLAR Coder Action Failure

    Affected: fixed in 14.11.1.

    Fixed in 14.11.1 (released Mar 24, 2026, 113 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-61861Medium 6.3

    ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-61858Medium 4.8

    ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-61857Medium 6.3

    ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-61465Medium 4.8

    ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56372Medium 4.8

    ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 89 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56373Medium 6.3

    ImageMagick - Use-After-Free Write in PDB Decoder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 137 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56366Medium 4.8

    ImageMagick - Memory Leak in META Reader APP1JPEG Error Path

    Affected: fixed in 14.11.1.

    Fixed in 14.11.1 (released Mar 24, 2026, 108 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56374Medium 4.8

    ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 86 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 135 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-55597Medium 5.5

    ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-55595Medium 4.7

    ImageMagick: Infinite Loop in connected-components when providing invalid arguments

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-55594Medium 5.3

    ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-55510Medium 5.5

    ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-53467Medium 5.3

    ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-53466Medium 6.5

    ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-55628Medium 5.5

    ImageMagick: Policy Bypass in concatenate operation due to missing checks

    Affected: fixed in 14.15.0.

    Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56369Medium 6.3

    ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56365Medium 6.3

    ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML

    Affected: fixed in 14.10.2.

    Fixed in 14.10.2 (released Jan 19, 2026, 162 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56363Medium 4.8

    ImageMagick - Division by Zero in Binomial Kernel Processing

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56361Medium 4.8

    ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56370Medium 4.8

    ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 72 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56368Medium 6.3

    ImageMagick - Memory Leak in Raw Pixel Data Coders

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 121 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56379Critical 9.2

    ImageMagick - Command Injection via SVG Decoder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 120 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56376Medium 6.3

    ImageMagick - Heap Use-After-Free in Meta Coder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 120 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56371Medium 6.9

    ImageMagick - Memory Leak in TXT File Processing via Texture Attribute

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 120 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56378Medium 6.3

    ImageMagick - Heap Out-of-Bounds Read in PCD Decoder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 118 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-56367Medium 6.3

    ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 118 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-53465Medium 6.2

    ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-53464Medium 4.0

    ImageMagick: Memory Leak in wand option parser when providing invalid arguments

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-53463Medium 4.3

    ImageMagick: Null Pointer Dereference in distort operation when passing incorrect arguments

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-53462Medium 5.9

    ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent fails

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick: Policy Bypass can trigger out-of-Memory condition

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-49219Medium 5.5

    ImageMagick: Policy Bypass can read disallowed files

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-48994Medium 5.9

    ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-48734Medium 5.5

    ImageMagick: Stack Overflow in MVG decoder

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-48733Medium 4.7

    ImageMagick: Infinite Loop in subimage-search with crafted image

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-48724Medium 5.5

    ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

    Affected: fixed in 14.14.0.

    Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-47166Medium 5.7

    ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 58 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-47165Medium 4.1

    ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 58 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-46693Medium 4.1

    ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 58 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-46692Medium 4.1

    ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, 58 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-46559Medium 4.0

    ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-46557Medium 6.2

    ImageMagick: Stack overflow in fx operation

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-46521Medium 5.5

    ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-45664Medium 5.3

    ImageMagick: Policy Bypass in MNG coder could

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-45624Medium 5.1

    ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-45359Medium 5.7

    ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-45358Medium 5.3

    ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-42326Medium 5.1

    ImageMagick: Heap Buffer Over-Read in IPTC encoder

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-45031Medium 5.3

    ImageMagick: Policy Bypass in PSD decoder

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-46523Medium 6.2

    ImageMagick: Use-After-Free in MSL decoder.

    Affected: fixed in 14.13.1.

    Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-40312Medium 6.2

    ImageMagick: Off-by-One in MSL decoder could result in crash

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-40311Medium 5.5

    ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing values

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-40310Medium 5.5

    ImageMagick: Heap out-of-bounds write in JP2 encoder

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-40183Medium 5.5

    ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit float

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-40169Medium 6.2

    ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encoders

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-34238Medium 5.1

    ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit builds

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-33905Medium 5.5

    ImageMagick has an Out-of-Bounds read via -sample operation

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-33902Medium 5.5

    ImageMagick: Stack Overflow via Recursive FX Expression Parsing

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has a Heap Buffer Overflow via MVG decoder

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-33900Medium 5.9

    ImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-33899Medium 5.3

    ImageMagick: Heap BufferOverflow write of single zero byte when parsing XML

    Affected: fixed in 14.12.0.

    Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-33536Medium 5.1

    ImageMagick has an Out-of-bounds Write via InterpretImageFilename

    Affected: fixed in 14.11.1.

    Fixed in 14.11.1 (released Mar 24, 2026, 2 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-33535Medium 4.0

    ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

    Affected: fixed in 14.11.1.

    Fixed in 14.11.1 (released Mar 24, 2026, 2 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-32636Medium 5.3

    ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

    Affected: fixed in 14.11.0.

    Fixed in 14.11.0 (released Mar 16, 2026, 2 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-31853Medium 5.7

    ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, 2 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-30937Medium 6.8

    ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-30936Medium 5.5

    ImageMagick has a heap Buffer Overflow in WaveletDenoiseImage

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-30935Medium 4.4

    ImageMagick has a heap Buffer Over-Read in BilateralBlurImage

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-30931Medium 6.8

    ImageMagick has a heap-based buffer overflow in UHDR encoder

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has a stack buffer overflow in MagnifyImage

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-30883Medium 5.7

    ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-28692Medium 4.8

    ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has an uninitialized pointer dereference in JBIG decoder

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-28690Medium 6.9

    ImageMagick has a stack write buffer overflow in MNG encoder

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-28689Medium 6.3

    ImageMagick has a Path Policy TOCTOU symlink race bypass

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-28688Medium 4.0

    ImageMagick has a heap use-after-free in the MSL encoder

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-28687Medium 5.3

    ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoder

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-28686Medium 6.8

    ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output buffer

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick affected by stack corruption through long morphology kernel names or arrays

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-28493Medium 6.5

    ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoder

    Affected: fixed in 14.10.4.

    Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-27799Medium 4.0

    ImageMagick has a heap Buffer Over-read in its DJVU image format handler

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 2 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-27798Medium 4.0

    ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 2 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-26983Medium 5.3

    ImageMagick: Invalid MSL <map> can result in a use after free

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-26284Medium 6.5

    ImageMagick has heap overflow in pcd decoder that leads to out of bounds read.

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-26283Medium 6.2

    ImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent`

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-26066Medium 6.2

    ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25988Medium 5.3

    ImageMagick's MSL image stack index not refreshed, leading to leaked images.

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25987Medium 5.3

    ImageMagick has heap buffer over-read in MAP image decoder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25986Medium 5.3

    ImageMagick has a heap buffer overflow in YUV 4:2:2 decoder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • Memory allocation with excessive without limits in the internal SVG decoder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25983Medium 5.3

    ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25982Medium 6.5

    ImageMagick Has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25971Medium 6.2

    ImageMagick's MSL: Stack overflow in ProcessMSLScript

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25970Medium 5.3

    ImageMagick SIXEL Decoder Has Signed Integer Overflow, Leading to Memory Corruption

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25969Medium 5.3

    ImageMagick has Memory Leak in coders/ashlar.c

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has MSL attribute stack buffer overflow that leads to out of bounds write.

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has stack buffer overflow in FTXT reader via oversized integer field

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25966Medium 5.9

    ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25898Medium 6.5

    Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25897Medium 6.5

    ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25799Medium 5.3

    ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25798Medium 5.3

    ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25797Medium 5.7

    ImageMagick vulnerable to Code injection via PostScript header in ps coders

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25796Medium 5.3

    ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25795Medium 5.3

    ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensions

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25638Medium 5.3

    ImageMagick has memory leak in msl encoder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25637Medium 5.3

    ImageMagick: Possible memory leak in ASHLAR encoder

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-25576Medium 5.1

    ImageMagick: Out of bounds read in multiple coders read raw pixel data

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick: Infinite loop vulnerability when parsing a PCD file

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-24484Medium 5.3

    ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

    Affected: fixed in 14.10.3.

    Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-23952Medium 6.5

    ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load

    Affected: fixed in 14.10.2.

    Fixed in 14.10.2 (released Jan 19, 2026, 3 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-23874Medium 5.5

    ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript

    Affected: fixed in 14.10.2.

    Fixed in 14.10.2 (released Jan 19, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2026-22770Medium 6.5

    ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails

    Affected: fixed in 14.10.2.

    Fixed in 14.10.2 (released Jan 19, 2026, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2025-68950Medium 4.0

    Magick's failure to limit MVG mutual references forming a loop

    Affected: fixed in 14.10.1.

    Fixed in 14.10.1 (released Dec 30, 2025, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2025-68618Medium 5.3

    Magick's failure to limit the depth of SVG file reads caused a DoS attack.

    Affected: fixed in 14.10.1.

    Fixed in 14.10.1 (released Dec 30, 2025, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick vulnerable to heap-buffer-overflow

    Affected: fixed in 13.2.0.

    Fixed in 13.2.0 (released Jul 24, 2023, 878 days before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)

    Affected: fixed in 14.10.0.

    Fixed in 14.10.0 (released Dec 10, 2025, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2025-62171Medium 5.9

    ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems

    Affected: fixed in 14.9.0.

    Fixed in 14.9.0 (released Oct 16, 2025, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow

    Affected: fixed in 14.8.1.

    Fixed in 14.8.1 (released Aug 26, 2025, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution

    Affected: fixed in 14.8.1.

    Fixed in 14.8.1 (released Aug 26, 2025, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

    Affected: fixed in 14.8.1.

    Fixed in 14.8.1 (released Aug 26, 2025, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2025-55160Medium 6.1

    ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTree

    Affected: fixed in 14.8.0.

    Fixed in 14.8.0 (released Aug 13, 2025, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick: integer overflows in MNG magnification

    Affected: fixed in 14.8.0.

    Fixed in 14.8.0 (released Aug 13, 2025, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick: heap-buffer overflow read in MNG magnification with alpha

    Affected: fixed in 14.8.0.

    Fixed in 14.8.0 (released Aug 13, 2025, the day of disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has Stack Buffer Overflow in image.c

    Affected: fixed in 14.7.0.

    Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has Memory Leak in magick stream

    Affected: fixed in 14.7.0.

    Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has XMP profile write that triggers hang due to unbounded loop

    Affected: fixed in 14.7.0.

    Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • ImageMagick has Heap Buffer Overflow in InterpretImageFilename

    Affected: fixed in 14.7.0.

    Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).

    The latest release, 15.1.0, is not affected.

  • CVE-2023-4863High 8.8 · KEV

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo

    Affected: fixed in 13.3.0.

    Fixed in 13.3.0 (released Sep 21, 2023, 9 days after disclosure).

    The latest release, 15.1.0, is not affected.

  • A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault.

    Affected: fixed in 13.0.0.

    Fixed in 13.0.0 (released Mar 13, 2023, 10 days before disclosure).

    The latest release, 15.1.0, is not affected.