| CVE-2026-62946 | MEDIO4.7 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This issue has been fixed in versions 6.9.13-52 | 30/07/2026 |
| CVE-2026-62363 | MEDIO5.0 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27. | 30/07/2026 |
| CVE-2026-62343 | MEDIO4.7 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. This issue has been fixed in ver | 30/07/2026 |
| CVE-2026-66011 | BAJO3.3 | ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources. | 25/07/2026 |
| GHSA-hc76-7mpc-qjqh | MEDIO5.7 | ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797 | 24/07/2026 |
| GHSA-56m6-8q75-f2rw | MEDIO4.7 | ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219 | 24/07/2026 |
| CVE-2026-61872 | BAJO2.5 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption. | 15/07/2026 |
| CVE-2026-61871 | BAJO3.7 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service. | 15/07/2026 |
| CVE-2026-61869 | BAJO2.9 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service. | 15/07/2026 |
| CVE-2026-61868 | BAJO3.7 | ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service). | 15/07/2026 |
| CVE-2026-61867 | BAJO2.9 | ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service. | 15/07/2026 |
| CVE-2026-61866 | ALTO7.5 | ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG files that fail blob operations, causing resource exhaustion. | 15/07/2026 |
| CVE-2026-61865 | BAJO2.9 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memory leak occurs. | 15/07/2026 |
| CVE-2026-61864 | BAJO2.9 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released. | 15/07/2026 |
| CVE-2026-61863 | ALTO7.5 | ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak. | 15/07/2026 |
| CVE-2026-61862 | BAJO2.9 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the profile boundary). This behavior occurs when debug output is ena | 15/07/2026 |
| CVE-2026-61860 | BAJO3.7 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service. | 15/07/2026 |
| CVE-2026-61859 | BAJO3.3 | ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy. | 15/07/2026 |
| CVE-2026-61464 | BAJO1.8 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service. | 15/07/2026 |
| CVE-2026-56375 | BAJO3.3 | ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and cause denial of service. | 15/07/2026 |