SB2026110301 - Multiple vulnerabilities in ImageMagick

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110301

SB2026110301 - Multiple vulnerabilities in ImageMagick

Published: November 3, 2026 Updated: November 12, 2026

Security Bulletin ID SB2026110301
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 22
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 32% Low 68%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 22 vulnerabilities.


1) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause excessive memory consumption and degrade service availability.

The vulnerability exists due to a missing policy check in the ImageMagick ASE decoder when processing ASE input. A remote attacker can supply specially crafted ASE input to bypass the policy check and trigger excessive memory usage.


2) Reusing a Nonce, Key Pair in Encryption (CVE-ID: N/A)

CWE-ID: CWE-323 - Reusing a Nonce, Key Pair in Encryption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose image data.

The vulnerability exists due to reuse of cryptographic nonces or key pairs in the ImageMagick distributed pixel cache server when protecting image data. A local user can monitor local unencrypted traffic to decrypt image data.


3) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ImageMagick's BGRO data import functionality when importing crafted BGRO data. A remote attacker can induce a user to import specially crafted BGRO data to read beyond a heap buffer, potentially disclosing adjacent memory contents.


4) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing ImageMagick.

The vulnerability exists due to a null pointer dereference in ImageMagick's -subimage option handling when processing a list containing only one image. A remote attacker can trick a user into processing a single-image list with this option to trigger a crash.


5) Double free (CVE-ID: N/A)

CWE-ID: CWE-415 - Double Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a double free in ImageMagick's DPC comparison functionality when comparing images using the DPC compare metric. A remote attacker can induce a user to process input that triggers the double free to cause a denial of service.


6) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds heap read in the ImageMagick TIFF decoder when processing a crafted TIFF image for encoding in a specific format. A remote attacker can trick a victim into processing such an image to read beyond heap buffer boundaries, potentially exposing sensitive information or crashing the application; the over-read can also lead to an out-of-bounds heap write.


7) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive memory usage.

The vulnerability exists due to a missing resource policy check in ImageMagick's XMP profile reader when processing XMP profiles. A remote attacker can supply a crafted XMP profile to trigger excessive memory consumption and reduce service availability.


8) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the ImageMagick EXR decoder when a specific memory allocation fails during image decoding. A remote attacker can submit an EXR image for decoding to trigger access to freed memory under this failure condition and cause a denial of service.


9) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the ImageMagick stream operation when processing a crafted set of images. A remote attacker can trick a user into processing specially crafted images with this operation to cause a denial of service.


10) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to inject additional headers or arbitrary code into output generated by ImageMagick.

The vulnerability exists due to improper control of code generation in the MAGICK, XBM, XPM and UIL encoders when encoding images using user-controlled filenames and directory names. A local user can manipulate the filename and directory in an accessible encoding location to inject additional headers or code into the generated output.


11) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the ImageMagick MSL decoder when processing a crafted MSL image. A remote attacker can supply a specially crafted MSL image to trigger access to freed memory, potentially disrupting image processing and causing a denial of service.


12) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating the application.

The vulnerability exists due to uncontrolled recursion in the ImageMagick MSVG decoder when processing a crafted image. A remote attacker can trick a victim into opening a crafted image to exhaust the stack and terminate the application.


13) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to potentially disclose sensitive information from process memory.

The vulnerability exists due to an out-of-bounds read in the ImageMagick MVG decoder when processing a crafted file. A remote attacker can trick a victim into opening a specially crafted file to potentially disclose information from heap memory beyond the allocated buffer.


14) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive memory consumption.

The vulnerability exists due to uncontrolled resource consumption in ImageMagick's image coders when reading image profiles without limiting their number. A remote attacker can submit an image containing a high number of profiles to trigger excessive memory allocation and degrade service availability.


15) Infinite loop (CVE-ID: CVE-2026-123273)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an infinite loop in the ImageMagick SVG decoder when processing a crafted image. A remote user can submit a specially crafted image for decoding to trigger the loop and cause a denial of service.


16) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose potentially sensitive heap information.

The vulnerability exists due to the inclusion of uninitialized data in the output of ImageMagick's RLA decoder when processing crafted images. A remote attacker can supply a specially crafted image to obtain a returned RLA image that may expose heap information.


17) Improper Resolution of Path Equivalence (CVE-ID: N/A)

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass path-based security policies and potentially read or write restricted image files on Windows.

The vulnerability exists due to improper resolution of equivalent path separators in ImageMagick's path-based policy matching when a user initiates image file reading or writing on Windows. A remote attacker can supply a path using an alternative directory separator to bypass policy restrictions and potentially read or write restricted image files.


18) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose potentially sensitive information from uninitialized memory.

The vulnerability exists due to use of an uninitialized resource in the ImageMagick MNG decoder when processing crafted images. A remote attacker can supply a specially crafted image to expose uninitialized memory contents.


19) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing image processing.

The vulnerability exists due to a reachable assertion in the ImageMagick BGR, CMYK, GRAY, RGB, YCBCR and YUV decoders when processing crafted images. A remote attacker can supply a specially crafted image to trigger a crash and disrupt availability.


20) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user on the local network to tamper with the resulting image by modifying pixel data.

The vulnerability exists due to cleartext transmission of sensitive information in ImageMagick's Distributed Pixel Cache when exchanging pixel data between a configured client and server. A remote user on the local network can modify pixel data on the network path between the client and server to alter the resulting image.


21) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to read files from paths disallowed by the security policy.

The vulnerability exists due to a missing authorization check in the ImageMagick MPC decoder when decoding MPC files. A local user can supply a crafted MPC file for decoding to bypass path restrictions and read otherwise disallowed files.


22) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose potentially sensitive information from heap memory.

The vulnerability exists due to an out-of-bounds read in ImageMagick's -copy operation when performing a copy. A remote attacker can induce a user to process crafted input with this operation to potentially disclose data from beyond the bounds of a heap buffer.


Remediation

Install update from vendor's website.

References