# Magick.NET-Q16-AnyCPU (NuGet) vulnerabilities

161 known vulnerabilities (1 critical, 27 high, 116 medium, 16 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 15.1.0 (Nov 5, 2026): no advisory affects it
- Newest unaffected release: 15.1.0 (Nov 5, 2026), the latest release
- Releases: 224 since 6.8.8.1001 (Apr 10, 2014)
- Registry: https://www.nuget.org/packages/Magick.NET-Q16-AnyCPU
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-62946: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-62363: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-62343: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-66011: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61872: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61871: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61869: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61868: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61867: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61866: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61865: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61864: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61863: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61862: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61860: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61859: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61464: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-56375: 6.8.8.1001 to 14.11.0 (14.11.1 is outside it)
- CVE-2026-61870: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61861: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61858: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61857: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-61465: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-56372: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56373: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56366: 6.8.8.1001 to 14.11.0 (14.11.1 is outside it)
- CVE-2026-56374: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56362: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-55597: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-55595: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-55594: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-55510: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-53467: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-53466: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-55628: 6.8.8.1001 to 14.14.0 (14.15.0 is outside it)
- CVE-2026-56369: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56365: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56364: 6.8.8.1001 to 14.10.1 (14.10.2 is outside it)
- CVE-2026-56363: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56361: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56370: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56368: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56379: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56376: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56371: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56378: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56367: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-53465: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-53464: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-53463: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-53462: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-53461: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-53460: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-49219: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-49218: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-48994: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-48734: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-48733: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-48724: 6.8.8.1001 to 14.13.1 (14.14.0 is outside it)
- CVE-2026-47166: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-47165: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-46693: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-46692: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-46559: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46557: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46521: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46520: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45664: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46522: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45624: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45359: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45358: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-42326: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45031: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46523: 6.8.8.1001 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-40312: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-40311: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-40310: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-40183: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-40169: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-34238: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-33908: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-33905: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-33902: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-33901: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-33900: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-33899: 6.8.8.1001 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-33536: 6.8.8.1001 to 14.11.0 (14.11.1 is outside it)
- CVE-2026-33535: 6.8.8.1001 to 14.11.0 (14.11.1 is outside it)
- CVE-2026-32636: 6.8.8.1001 to 14.10.4 (14.11.0 is outside it)
- CVE-2026-31853: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30937: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30936: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30935: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30931: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30929: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30883: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28693: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28692: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28691: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28690: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28689: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28688: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28687: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28686: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28494: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28493: 6.8.8.1001 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-27799: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-27798: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-26983: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-26284: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-26283: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-26066: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25989: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25988: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25987: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25986: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25985: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25983: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25982: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25971: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25970: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25969: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25968: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25967: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25966: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25965: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25898: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25897: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25799: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25798: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25797: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25796: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25795: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25794: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25638: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25637: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25576: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-24485: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-24484: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-24481: 6.8.8.1001 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-23952: 6.8.8.1001 to 14.10.1 (14.10.2 is outside it)
- CVE-2026-23874: 6.8.8.1001 to 14.10.1 (14.10.2 is outside it)
- CVE-2026-22770: 6.8.8.1001 to 14.10.1 (14.10.2 is outside it)
- CVE-2025-68950: 6.8.8.1001 to 14.10.0 (14.10.1 is outside it)
- CVE-2025-68618: 6.8.8.1001 to 14.10.0 (14.10.1 is outside it)
- CVE-2025-68469: 6.8.8.1001 to 13.1.3 (13.2.0 is outside it)
- CVE-2025-66628: 6.8.8.1001 to 14.9.1 (14.10.0 is outside it)
- CVE-2025-62171: 6.8.8.1001 to 14.8.2 (14.9.0 is outside it)
- CVE-2025-57803: 6.8.8.1001 to 14.8.0 (14.8.1 is outside it)
- CVE-2025-55298: 6.8.8.1001 to 14.8.0 (14.8.1 is outside it)
- CVE-2025-55212: 6.8.8.1001 to 14.8.0 (14.8.1 is outside it)
- CVE-2025-55160: 6.8.8.1001 to 14.7.0 (14.8.0 is outside it)
- CVE-2025-55154: 6.8.8.1001 to 14.7.0 (14.8.0 is outside it)
- CVE-2025-55004: 6.8.8.1001 to 14.7.0 (14.8.0 is outside it)
- CVE-2025-53101: 6.8.8.1001 to 14.6.0 (14.7.0 is outside it)
- CVE-2025-53019: 6.8.8.1001 to 14.6.0 (14.7.0 is outside it)
- CVE-2025-53015: 6.8.8.1001 to 14.6.0 (14.7.0 is outside it)
- CVE-2025-53014: 6.8.8.1001 to 14.6.0 (14.7.0 is outside it)
- CVE-2023-4863: 6.8.8.1001 to 13.2.0 (13.3.0 is outside it)
- CVE-2023-1289: 6.8.8.1001 to 12.3.0 (13.0.0 is outside it)

## Advisories (161)

### [CVE-2026-62946](https://cve.now/CVE-2026-62946): ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

- Severity: Medium 5.1
- Published: Jul 30, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 18 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-62363](https://cve.now/CVE-2026-62363): ImageMagick: Heap Buffer Over-Write in fx operation

- Severity: Medium 5.0
- Published: Jul 30, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 18 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-62343](https://cve.now/CVE-2026-62343): ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

- Severity: Medium 4.7
- Published: Jul 29, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 17 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-66011](https://cve.now/CVE-2026-66011): ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options

- Severity: Medium 4.8
- Published: Jul 25, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 13 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61872](https://cve.now/CVE-2026-61872): ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder

- Severity: Low 2.0
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61871](https://cve.now/CVE-2026-61871): ImageMagick before 7.1.2-26 Memory Leak in ICON decoder

- Severity: Medium 6.3
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61869](https://cve.now/CVE-2026-61869): ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder

- Severity: Low 2.1
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61868](https://cve.now/CVE-2026-61868): ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder

- Severity: Medium 6.3
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61867](https://cve.now/CVE-2026-61867): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder

- Severity: Low 2.1
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61866](https://cve.now/CVE-2026-61866): ImageMagick before 7.1.2-26 Memory Leak in JNG encoder

- Severity: Low 2.1
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61865](https://cve.now/CVE-2026-61865): ImageMagick before 7.1.2-26 Memory Leak in Hough Lines

- Severity: Low 2.1
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61864](https://cve.now/CVE-2026-61864): ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace

- Severity: Low 2.1
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61863](https://cve.now/CVE-2026-61863): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder

- Severity: Low 2.1
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61862](https://cve.now/CVE-2026-61862): ImageMagick before 7.1.2-26 Information Disclosure via identify

- Severity: Low 2.1
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61860](https://cve.now/CVE-2026-61860): ImageMagick before 7.1.2-26 Use-After-Free via freetype

- Severity: Medium 6.3
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61859](https://cve.now/CVE-2026-61859): ImageMagick before 7.1.2-26 Policy Bypass via script operation

- Severity: Medium 4.8
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61464](https://cve.now/CVE-2026-61464): ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11

- Severity: Low 1.0
- Published: Jul 15, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56375](https://cve.now/CVE-2026-56375): ImageMagick - Memory Leak in ASHLAR Coder Action Failure

- Severity: Medium 4.8
- Published: Jul 15, 2026
- Affected: fixed in 14.11.1.
- Fixed in 14.11.1 (released Mar 24, 2026, 113 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61870](https://cve.now/CVE-2026-61870): ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder

- Severity: Low 2.1
- Published: Jul 11, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61861](https://cve.now/CVE-2026-61861): ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption

- Severity: Medium 6.3
- Published: Jul 11, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61858](https://cve.now/CVE-2026-61858): ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder

- Severity: Medium 4.8
- Published: Jul 11, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61857](https://cve.now/CVE-2026-61857): ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP

- Severity: Medium 6.3
- Published: Jul 11, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-61465](https://cve.now/CVE-2026-61465): ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass

- Severity: Medium 4.8
- Published: Jul 11, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 1 day after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56372](https://cve.now/CVE-2026-56372): ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method

- Severity: Medium 4.8
- Published: Jul 11, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 89 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56373](https://cve.now/CVE-2026-56373): ImageMagick - Use-After-Free Write in PDB Decoder

- Severity: Medium 6.3
- Published: Jul 10, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 137 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56366](https://cve.now/CVE-2026-56366): ImageMagick - Memory Leak in META Reader APP1JPEG Error Path

- Severity: Medium 4.8
- Published: Jul 10, 2026
- Affected: fixed in 14.11.1.
- Fixed in 14.11.1 (released Mar 24, 2026, 108 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56374](https://cve.now/CVE-2026-56374): ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter

- Severity: Medium 4.8
- Published: Jul 8, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 86 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56362](https://cve.now/CVE-2026-56362): ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization

- Severity: Low 2.1
- Published: Jul 8, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 135 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-55597](https://cve.now/CVE-2026-55597): ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

- Severity: Medium 5.5
- Published: Jul 1, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-55595](https://cve.now/CVE-2026-55595): ImageMagick: Infinite Loop in connected-components when providing invalid arguments

- Severity: Medium 4.7
- Published: Jul 1, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-55594](https://cve.now/CVE-2026-55594): ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

- Severity: Medium 5.3
- Published: Jul 1, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-55510](https://cve.now/CVE-2026-55510): ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

- Severity: Medium 5.5
- Published: Jul 1, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-53467](https://cve.now/CVE-2026-53467): ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

- Severity: Medium 5.3
- Published: Jul 1, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-53466](https://cve.now/CVE-2026-53466): ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

- Severity: Medium 6.5
- Published: Jul 1, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-55628](https://cve.now/CVE-2026-55628): ImageMagick: Policy Bypass in concatenate operation due to missing checks

- Severity: Medium 5.5
- Published: Jul 1, 2026
- Affected: fixed in 14.15.0.
- Fixed in 14.15.0 (released Jul 12, 2026, 11 days after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56369](https://cve.now/CVE-2026-56369): ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage

- Severity: Medium 6.3
- Published: Jun 30, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56365](https://cve.now/CVE-2026-56365): ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing

- Severity: Medium 6.3
- Published: Jun 30, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56364](https://cve.now/CVE-2026-56364): ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML

- Severity: Low 1.8
- Published: Jun 30, 2026
- Affected: fixed in 14.10.2.
- Fixed in 14.10.2 (released Jan 19, 2026, 162 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56363](https://cve.now/CVE-2026-56363): ImageMagick - Division by Zero in Binomial Kernel Processing

- Severity: Medium 4.8
- Published: Jun 30, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56361](https://cve.now/CVE-2026-56361): ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing

- Severity: Medium 4.8
- Published: Jun 30, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56370](https://cve.now/CVE-2026-56370): ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact

- Severity: Medium 4.8
- Published: Jun 24, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 72 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56368](https://cve.now/CVE-2026-56368): ImageMagick - Memory Leak in Raw Pixel Data Coders

- Severity: Medium 6.3
- Published: Jun 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 121 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56379](https://cve.now/CVE-2026-56379): ImageMagick - Command Injection via SVG Decoder

- Severity: Critical 9.2
- Published: Jun 23, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 120 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56376](https://cve.now/CVE-2026-56376): ImageMagick - Heap Use-After-Free in Meta Coder

- Severity: Medium 6.3
- Published: Jun 23, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 120 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56371](https://cve.now/CVE-2026-56371): ImageMagick - Memory Leak in TXT File Processing via Texture Attribute

- Severity: Medium 6.9
- Published: Jun 23, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 120 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56378](https://cve.now/CVE-2026-56378): ImageMagick - Heap Out-of-Bounds Read in PCD Decoder

- Severity: Medium 6.3
- Published: Jun 21, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 118 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56367](https://cve.now/CVE-2026-56367): ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding

- Severity: Medium 6.3
- Published: Jun 21, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 118 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-53465](https://cve.now/CVE-2026-53465): ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

- Severity: Medium 6.2
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-53464](https://cve.now/CVE-2026-53464): ImageMagick: Memory Leak in wand option parser when providing invalid arguments

- Severity: Medium 4.0
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-53463](https://cve.now/CVE-2026-53463): ImageMagick: Null Pointer Dereference in distort operation when passing incorrect arguments

- Severity: Medium 4.3
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-53462](https://cve.now/CVE-2026-53462): ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent fails

- Severity: Medium 5.9
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-53461](https://cve.now/CVE-2026-53461): ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop

- Severity: High 7.5
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-53460](https://cve.now/CVE-2026-53460): ImageMagick: Policy Bypass can trigger out-of-Memory condition

- Severity: High 7.5
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-49219](https://cve.now/CVE-2026-49219): ImageMagick: Policy Bypass can read disallowed files

- Severity: Medium 5.5
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-49218](https://cve.now/CVE-2026-49218): ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

- Severity: High 7.5
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-48994](https://cve.now/CVE-2026-48994): ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems

- Severity: Medium 5.9
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-48734](https://cve.now/CVE-2026-48734): ImageMagick: Stack Overflow in MVG decoder

- Severity: Medium 5.5
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-48733](https://cve.now/CVE-2026-48733): ImageMagick: Infinite Loop in subimage-search with crafted image

- Severity: Medium 4.7
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-48724](https://cve.now/CVE-2026-48724): ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

- Severity: Medium 5.5
- Published: Jun 10, 2026
- Affected: fixed in 14.14.0.
- Fixed in 14.14.0 (released Jun 6, 2026, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-47166](https://cve.now/CVE-2026-47166): ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

- Severity: Medium 5.7
- Published: Jun 10, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 58 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-47165](https://cve.now/CVE-2026-47165): ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

- Severity: Medium 4.1
- Published: Jun 10, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 58 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46693](https://cve.now/CVE-2026-46693): ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

- Severity: Medium 4.1
- Published: Jun 10, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 58 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46692](https://cve.now/CVE-2026-46692): ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

- Severity: Medium 4.1
- Published: Jun 10, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 58 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46559](https://cve.now/CVE-2026-46559): ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder

- Severity: Medium 4.0
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46557](https://cve.now/CVE-2026-46557): ImageMagick: Stack overflow in fx operation

- Severity: Medium 6.2
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46521](https://cve.now/CVE-2026-46521): ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

- Severity: Medium 5.5
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46520](https://cve.now/CVE-2026-46520): ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

- Severity: High 7.5
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45664](https://cve.now/CVE-2026-45664): ImageMagick: Policy Bypass in MNG coder could

- Severity: Medium 5.3
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46522](https://cve.now/CVE-2026-46522): ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

- Severity: High 7.5
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45624](https://cve.now/CVE-2026-45624): ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

- Severity: Medium 5.1
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45359](https://cve.now/CVE-2026-45359): ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

- Severity: Medium 5.7
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45358](https://cve.now/CVE-2026-45358): ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

- Severity: Medium 5.3
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-42326](https://cve.now/CVE-2026-42326): ImageMagick: Heap Buffer Over-Read in IPTC encoder

- Severity: Medium 5.1
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45031](https://cve.now/CVE-2026-45031): ImageMagick: Policy Bypass in PSD decoder

- Severity: Medium 5.3
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46523](https://cve.now/CVE-2026-46523): ImageMagick: Use-After-Free in MSL decoder.

- Severity: Medium 6.2
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-40312](https://cve.now/CVE-2026-40312): ImageMagick: Off-by-One in MSL decoder could result in crash

- Severity: Medium 6.2
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-40311](https://cve.now/CVE-2026-40311): ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing values

- Severity: Medium 5.5
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-40310](https://cve.now/CVE-2026-40310): ImageMagick: Heap out-of-bounds write in JP2 encoder

- Severity: Medium 5.5
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-40183](https://cve.now/CVE-2026-40183): ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit float

- Severity: Medium 5.5
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-40169](https://cve.now/CVE-2026-40169): ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encoders

- Severity: Medium 6.2
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-34238](https://cve.now/CVE-2026-34238): ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit builds

- Severity: Medium 5.1
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-33908](https://cve.now/CVE-2026-33908): ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()

- Severity: High 7.5
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-33905](https://cve.now/CVE-2026-33905): ImageMagick has an Out-of-Bounds read via -sample operation

- Severity: Medium 5.5
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-33902](https://cve.now/CVE-2026-33902): ImageMagick: Stack Overflow via Recursive FX Expression Parsing

- Severity: Medium 5.5
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-33901](https://cve.now/CVE-2026-33901): ImageMagick has a Heap Buffer Overflow via MVG decoder

- Severity: High 7.5
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-33900](https://cve.now/CVE-2026-33900): ImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds

- Severity: Medium 5.9
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-33899](https://cve.now/CVE-2026-33899): ImageMagick: Heap BufferOverflow write of single zero byte when parsing XML

- Severity: Medium 5.3
- Published: Apr 13, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-33536](https://cve.now/CVE-2026-33536): ImageMagick has an Out-of-bounds Write via InterpretImageFilename

- Severity: Medium 5.1
- Published: Mar 26, 2026
- Affected: fixed in 14.11.1.
- Fixed in 14.11.1 (released Mar 24, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-33535](https://cve.now/CVE-2026-33535): ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

- Severity: Medium 4.0
- Published: Mar 26, 2026
- Affected: fixed in 14.11.1.
- Fixed in 14.11.1 (released Mar 24, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-32636](https://cve.now/CVE-2026-32636): ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

- Severity: Medium 5.3
- Published: Mar 18, 2026
- Affected: fixed in 14.11.0.
- Fixed in 14.11.0 (released Mar 16, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-31853](https://cve.now/CVE-2026-31853): ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder

- Severity: Medium 5.7
- Published: Mar 11, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30937](https://cve.now/CVE-2026-30937): ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes\_per\_line calculation

- Severity: Medium 6.8
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30936](https://cve.now/CVE-2026-30936): ImageMagick has a heap Buffer Overflow in WaveletDenoiseImage

- Severity: Medium 5.5
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30935](https://cve.now/CVE-2026-30935): ImageMagick has a heap Buffer Over-Read in BilateralBlurImage

- Severity: Medium 4.4
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30931](https://cve.now/CVE-2026-30931): ImageMagick has a heap-based buffer overflow in UHDR encoder

- Severity: Medium 6.8
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30929](https://cve.now/CVE-2026-30929): ImageMagick has a stack buffer overflow in MagnifyImage

- Severity: High 7.7
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30883](https://cve.now/CVE-2026-30883): ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder

- Severity: Medium 5.7
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28693](https://cve.now/CVE-2026-28693): ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write

- Severity: High 8.1
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28692](https://cve.now/CVE-2026-28692): ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder

- Severity: Medium 4.8
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28691](https://cve.now/CVE-2026-28691): ImageMagick has an uninitialized pointer dereference in JBIG decoder

- Severity: High 7.5
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28690](https://cve.now/CVE-2026-28690): ImageMagick has a stack write buffer overflow in MNG encoder

- Severity: Medium 6.9
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28689](https://cve.now/CVE-2026-28689): ImageMagick has a Path Policy TOCTOU symlink race bypass

- Severity: Medium 6.3
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28688](https://cve.now/CVE-2026-28688): ImageMagick has a heap use-after-free in the MSL encoder

- Severity: Medium 4.0
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28687](https://cve.now/CVE-2026-28687): ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoder

- Severity: Medium 5.3
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28686](https://cve.now/CVE-2026-28686): ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output buffer

- Severity: Medium 6.8
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28494](https://cve.now/CVE-2026-28494): ImageMagick affected by stack corruption through long morphology kernel names or arrays

- Severity: High 7.1
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28493](https://cve.now/CVE-2026-28493): ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoder

- Severity: Medium 6.5
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-27799](https://cve.now/CVE-2026-27799): ImageMagick has a heap Buffer Over-read in its DJVU image format handler

- Severity: Medium 4.0
- Published: Feb 25, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-27798](https://cve.now/CVE-2026-27798): ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images

- Severity: Medium 4.0
- Published: Feb 25, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-26983](https://cve.now/CVE-2026-26983): ImageMagick: Invalid MSL \<map\> can result in a use after free

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-26284](https://cve.now/CVE-2026-26284): ImageMagick has heap overflow in pcd decoder that leads to out of bounds read.

- Severity: Medium 6.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-26283](https://cve.now/CVE-2026-26283): ImageMagick has possible infinite loop in JPEG encoder when using \`jpeg:extent\`

- Severity: Medium 6.2
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-26066](https://cve.now/CVE-2026-26066): ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile

- Severity: Medium 6.2
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25989](https://cve.now/CVE-2026-25989): ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

- Severity: High 7.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25988](https://cve.now/CVE-2026-25988): ImageMagick's MSL image stack index not refreshed, leading to leaked images.

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25987](https://cve.now/CVE-2026-25987): ImageMagick has heap buffer over-read in MAP image decoder

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25986](https://cve.now/CVE-2026-25986): ImageMagick has a heap buffer overflow in YUV 4:2:2 decoder

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25985](https://cve.now/CVE-2026-25985): Memory allocation with excessive without limits in the internal SVG decoder

- Severity: High 7.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25983](https://cve.now/CVE-2026-25983): ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25982](https://cve.now/CVE-2026-25982): ImageMagick Has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)

- Severity: Medium 6.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25971](https://cve.now/CVE-2026-25971): ImageMagick's MSL: Stack overflow in ProcessMSLScript

- Severity: Medium 6.2
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25970](https://cve.now/CVE-2026-25970): ImageMagick SIXEL Decoder Has Signed Integer Overflow, Leading to Memory Corruption

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25969](https://cve.now/CVE-2026-25969): ImageMagick has Memory Leak in coders/ashlar.c

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25968](https://cve.now/CVE-2026-25968): ImageMagick has MSL attribute stack buffer overflow that leads to out of bounds write.

- Severity: High 7.4
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25967](https://cve.now/CVE-2026-25967): ImageMagick has stack buffer overflow in FTXT reader via oversized integer field

- Severity: High 7.4
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25966](https://cve.now/CVE-2026-25966): ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

- Severity: Medium 5.9
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25965](https://cve.now/CVE-2026-25965): ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy

- Severity: High 8.6
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25898](https://cve.now/CVE-2026-25898): Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

- Severity: Medium 6.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25897](https://cve.now/CVE-2026-25897): ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write

- Severity: Medium 6.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25799](https://cve.now/CVE-2026-25799): ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25798](https://cve.now/CVE-2026-25798): ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25797](https://cve.now/CVE-2026-25797): ImageMagick vulnerable to Code injection via PostScript header in ps coders

- Severity: Medium 5.7
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25796](https://cve.now/CVE-2026-25796): ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25795](https://cve.now/CVE-2026-25795): ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25794](https://cve.now/CVE-2026-25794): ImageMagick has heap-buffer-overflow via signed integer overflow in \`WriteUHDRImage\` when writing UHDR images with large dimensions

- Severity: High 8.2
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25638](https://cve.now/CVE-2026-25638): ImageMagick has memory leak in msl encoder

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25637](https://cve.now/CVE-2026-25637): ImageMagick: Possible memory leak in ASHLAR encoder

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25576](https://cve.now/CVE-2026-25576): ImageMagick: Out of bounds read in multiple coders read raw pixel data

- Severity: Medium 5.1
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-24485](https://cve.now/CVE-2026-24485): ImageMagick: Infinite loop vulnerability when parsing a PCD file

- Severity: High 7.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-24484](https://cve.now/CVE-2026-24484): ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-24481](https://cve.now/CVE-2026-24481): ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

- Severity: High 7.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-23952](https://cve.now/CVE-2026-23952): ImageMagick has a NULL pointer dereference in MSL parser via \<comment\> tag before image load

- Severity: Medium 6.5
- Published: Jan 22, 2026
- Affected: fixed in 14.10.2.
- Fixed in 14.10.2 (released Jan 19, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-23874](https://cve.now/CVE-2026-23874): ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript

- Severity: Medium 5.5
- Published: Jan 20, 2026
- Affected: fixed in 14.10.2.
- Fixed in 14.10.2 (released Jan 19, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-22770](https://cve.now/CVE-2026-22770): ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails

- Severity: Medium 6.5
- Published: Jan 20, 2026
- Affected: fixed in 14.10.2.
- Fixed in 14.10.2 (released Jan 19, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-68950](https://cve.now/CVE-2025-68950): Magick's failure to limit MVG mutual references forming a loop

- Severity: Medium 4.0
- Published: Dec 30, 2025
- Affected: fixed in 14.10.1.
- Fixed in 14.10.1 (released Dec 30, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-68618](https://cve.now/CVE-2025-68618): Magick's failure to limit the depth of SVG file reads caused a DoS attack.

- Severity: Medium 5.3
- Published: Dec 30, 2025
- Affected: fixed in 14.10.1.
- Fixed in 14.10.1 (released Dec 30, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-68469](https://cve.now/CVE-2025-68469): ImageMagick vulnerable to heap-buffer-overflow

- Severity: Low 2.0
- Published: Dec 18, 2025
- Affected: fixed in 13.2.0.
- Fixed in 13.2.0 (released Jul 24, 2023, 878 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-66628](https://cve.now/CVE-2025-66628): ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)

- Severity: High 7.5
- Published: Dec 10, 2025
- Affected: fixed in 14.10.0.
- Fixed in 14.10.0 (released Dec 10, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-62171](https://cve.now/CVE-2025-62171): ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems

- Severity: Medium 5.9
- Published: Oct 17, 2025
- Affected: fixed in 14.9.0.
- Fixed in 14.9.0 (released Oct 16, 2025, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-57803](https://cve.now/CVE-2025-57803): ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow

- Severity: High 7.5
- Published: Aug 26, 2025
- Affected: fixed in 14.8.1.
- Fixed in 14.8.1 (released Aug 26, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55298](https://cve.now/CVE-2025-55298): ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution

- Severity: High 7.5
- Published: Aug 26, 2025
- Affected: fixed in 14.8.1.
- Fixed in 14.8.1 (released Aug 26, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55212](https://cve.now/CVE-2025-55212): ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

- Severity: Low 3.7
- Published: Aug 26, 2025
- Affected: fixed in 14.8.1.
- Fixed in 14.8.1 (released Aug 26, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55160](https://cve.now/CVE-2025-55160): ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTree

- Severity: Medium 6.1
- Published: Aug 13, 2025
- Affected: fixed in 14.8.0.
- Fixed in 14.8.0 (released Aug 13, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55154](https://cve.now/CVE-2025-55154): ImageMagick: integer overflows in MNG magnification

- Severity: High 8.8
- Published: Aug 13, 2025
- Affected: fixed in 14.8.0.
- Fixed in 14.8.0 (released Aug 13, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55004](https://cve.now/CVE-2025-55004): ImageMagick: heap-buffer overflow read in MNG magnification with alpha

- Severity: High 7.6
- Published: Aug 13, 2025
- Affected: fixed in 14.8.0.
- Fixed in 14.8.0 (released Aug 13, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-53101](https://cve.now/CVE-2025-53101): ImageMagick has Stack Buffer Overflow in image.c

- Severity: High 7.4
- Published: Jul 14, 2025
- Affected: fixed in 14.7.0.
- Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-53019](https://cve.now/CVE-2025-53019): ImageMagick has Memory Leak in magick stream

- Severity: Low 3.7
- Published: Jul 14, 2025
- Affected: fixed in 14.7.0.
- Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-53015](https://cve.now/CVE-2025-53015): ImageMagick has XMP profile write that triggers hang due to unbounded loop

- Severity: High 7.5
- Published: Jul 14, 2025
- Affected: fixed in 14.7.0.
- Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-53014](https://cve.now/CVE-2025-53014): ImageMagick has Heap Buffer Overflow in InterpretImageFilename

- Severity: Low 3.7
- Published: Jul 14, 2025
- Affected: fixed in 14.7.0.
- Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2023-4863](https://cve.now/CVE-2023-4863): Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo

- Severity: High 8.8 · KEV
- Published: Sep 12, 2023
- Affected: fixed in 13.3.0.
- Fixed in 13.3.0 (released Sep 21, 2023, 9 days after disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2023-1289](https://cve.now/CVE-2023-1289): A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault.

- Severity: Unrated
- Published: Mar 23, 2023
- Affected: fixed in 13.0.0.
- Fixed in 13.0.0 (released Mar 13, 2023, 10 days before disclosure).
- The latest release, 15.1.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/nuget/magick.net-q16-anycpu
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.