Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
929 results · page 3 of 19
Jul 15, 2026ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profilCVE-2026-61862 · Other software · ImageMagick · reported by VulnCheckLow 2.1
ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the profile boundary). This behavior occurs when debug output is enabled.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 15, 2026ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and cCVE-2026-61860 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 15, 2026ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks.CVE-2026-61859 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 15, 2026ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window titCVE-2026-61464 · Other software · ImageMagick · reported by VulnCheckLow 1
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 15, 2026ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails.CVE-2026-56375 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and cause denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 11, 2026ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails.CVE-2026-61870 · Other software · ImageMagick · reported by VulnCheckLow 2.1
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 11, 2026ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails.CVE-2026-61861 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 11, 2026ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks.CVE-2026-61858 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 11, 2026ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles.CVE-2026-61857 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 11, 2026ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny.CVE-2026-61465 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 11, 2026ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory.CVE-2026-56372 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 10, 2026ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails.CVE-2026-56373 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 10, 2026ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths.CVE-2026-56366 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 8, 2026ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format.CVE-2026-56374 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of service or information disclosure.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 8, 2026ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before CVE-2026-56362 · Other software · ImageMagick · reported by VulnCheckLow 2.1
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting any writer calling GetPixelIndex.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 1, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-55628 · Other software · ImageMagick · reported by GitHubMedium 5.5
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-55597 · Other software · ImageMagick · reported by GitHubMedium 5.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-55595 · Other software · ImageMagick · reported by GitHubMedium 4.7
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-55594 · Other software · ImageMagick · reported by GitHubMedium 5.3
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-55577 · Other software · ImageMagick · reported by GitHubMedium 5.9
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-55510 · Other software · ImageMagick · reported by GitHubMedium 5.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-53467 · Other software · ImageMagick · reported by GitHubMedium 5.3
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-53466 · Other software · ImageMagick · reported by GitHubMedium 6.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies.CVE-2026-56377 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 30, 2026ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse.CVE-2026-56369 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 30, 2026ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images.CVE-2026-56365 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 30, 2026ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files CVE-2026-56364 · Other software · ImageMagick · reported by VulnCheckLow 1.8
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service.CVE-2026-56363 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 30, 2026ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads.CVE-2026-56361 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 24, 2026ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invCVE-2026-56370 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 24, 2026ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed.CVE-2026-56368 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 23, 2026ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing coCVE-2026-56379 · Other software · ImageMagick · reported by VulnCheckCritical 9.2
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 23, 2026ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale poCVE-2026-56376 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 23, 2026ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocatedCVE-2026-56371 · Other software · ImageMagick · reported by VulnCheckMedium 6.9
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 21, 2026ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop.CVE-2026-56378 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 21, 2026ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) thCVE-2026-56367 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-53465 · Other software · ImageMagick · reported by GitHubMedium 6.2
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, a crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder. This issue has been patched in version 7.1.2-25.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-53464 · Other software · ImageMagick · reported by GitHubMedium 4
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, when providing invalid options to the wand option parser a small memory leak will occur. This issue has been patched in version 7.1.2-25.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-53463 · Other software · ImageMagick · reported by GitHubMedium 4.3
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when passing incorrect arguments in the distort operation a null pointer deference will occur. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-53462 · Other software · ImageMagick · reported by GitHubMedium 5.9
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-53461 · Other software · ImageMagick · reported by GitHubHigh 7.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-53460 · Other software · ImageMagick · reported by GitHubHigh 7.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-49219 · Other software · ImageMagick · reported by GitHubMedium 5.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-49218 · Other software · ImageMagick · reported by GitHubHigh 7.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-48994 · Other software · ImageMagick · reported by GitHubMedium 5.9
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-48734 · Other software · ImageMagick · reported by GitHubMedium 5.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. This issue has been patched in versions 6.9.13-49 and 7.1.2-24.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-48733 · Other software · ImageMagick · reported by GitHubMedium 4.7
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in the subimage-search operation can happen when using a crafted image. This issue has been patched in versions 6.9.13-49 and 7.1.2-24.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-48724 · Other software · ImageMagick · reported by GitHubMedium 5.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-24, when using an image with mask the Floyd-Steinberg dithering method it will cause a negative heap buffer over-write. This issue has been patched in version 7.1.2-24.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-47166 · Other software · ImageMagick · reported by GitHubMedium 5.7
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-47165 · Other software · ImageMagick · reported by GitHubMedium 4.1
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challenge–response authentication model. This has been changed in versions 6.9.13-48 and 7.1.2-23.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.