SB2026101236 - Multiple vulnerabilities in ImageMagick

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101236

SB2026101236 - Multiple vulnerabilities in ImageMagick

Published: October 12, 2026

Security Bulletin ID SB2026101236
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 10% Medium 10% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass execution restrictions defined in policy.xml.

The vulnerability exists due to incorrect parsing in delegate invocation handling when checking whether an executable is blocked by policy.xml. A remote attacker can cause a blocked executable to run through a delegate to bypass execution restrictions defined in policy.xml.

Exploitation requires user interaction.


2) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the MVG decoder when reading files with specific arguments. A remote attacker can trick the victim into reading an MVG file with those arguments to cause a denial of service.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without timely enforcement of image dimension limits in the UHDR decoder when decoding UHDR images. A remote attacker can supply images that exceed width or height policy limits to cause a denial of service.

Width and height checks occur only after decoding has completed.


4) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a heap buffer over-read in the minimum-bounding-box printing feature when processing an image to print its minimum-bounding-box. A remote attacker can supply a crafted image to disclose sensitive information.

Exploitation requires user interaction.


5) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to insufficient enforcement of list-length resource limits in the ImageMagick PS, PDF and XPS decoders when decoding input with a specific argument. A local user can specify that argument to bypass scene selection and cause a denial of service.


6) Protection mechanism failure (CVE-ID: N/A)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to bypass security policies.

The vulnerability exists due to a protection mechanism failure in ImageMagick's policy enforcement when enforcing security policies. A local privileged user can exploit the policy enforcement failure to bypass security policies.


7) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to bypass policy checks.

The vulnerability exists due to improper link resolution before file access in IsRightsAuthorizedByName when checking access to paths containing symbolic links. A local user can create a local symbolic link to bypass policy checks.


8) Memory leak (CVE-ID: N/A)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after its effective lifetime in the ImageMagick MSL decoder when processing MSL images. A remote attacker can supply a crafted MSL image to cause a denial of service through a memory leak.


9) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the ImageMagick DJVU decoder when a memory allocation fails. A remote attacker can trigger DJVU decoding under allocation-failure conditions to cause a denial of service.


10) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in MNG magnification caused by an incomplete fix for #VU114264 (CVE-2025-55154). A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.


Remediation

Install update from vendor's website.

References