ImageMagick vulnerabilities
262 CVEs and advisories name ImageMagick as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-25971ImageMagick's MSL: Stack overflow in ProcessMSLScript
- CVE-2026-25970ImageMagick SIXEL Decoder Has Signed Integer Overflow, Leading to Memory Corruption
- CVE-2026-25969ImageMagick has Memory Leak in coders/ashlar.c
- CVE-2026-25968ImageMagick has MSL attribute stack buffer overflow that leads to out of bounds write.
- CVE-2026-25967ImageMagick has stack buffer overflow in FTXT reader via oversized integer field
- CVE-2026-25966ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access
- CVE-2026-25965ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy
- CVE-2026-25898Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer
- CVE-2026-25897ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write
- CVE-2026-25799ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash
- CVE-2026-25798ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image
- CVE-2026-25797ImageMagick vulnerable to Code injection via PostScript header in ps coders
- CVE-2026-25796ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths
- CVE-2026-25795ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)
- CVE-2026-25794ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensions
- CVE-2026-25638ImageMagick has memory leak in msl encoder
- CVE-2026-25637ImageMagick: Possible memory leak in ASHLAR encoder
- CVE-2026-25576ImageMagick: Out of bounds read in multiple coders read raw pixel data
- CVE-2026-24485ImageMagick: Infinite loop vulnerability when parsing a PCD file
- CVE-2026-24484ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS
- CVE-2026-24481ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression
- CVE-2026-23952ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load
- CVE-2026-23876Heap buffer overflow with attacker-controlled data in XBM parser
- CVE-2026-23874ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript
- CVE-2026-22770ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails
- CVE-2025-69204ImageMagick converting a malicious MVG file to SVG caused an integer overflow.
- CVE-2025-68950Magick's failure to limit MVG mutual references forming a loop
- CVE-2025-68618Magick's failure to limit the depth of SVG file reads caused a DoS attack.
- CVE-2025-68469ImageMagick vulnerable to heap-buffer-overflow
- CVE-2025-66628ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)