IM
Product
ImageMagick
On CISA KEVExploited in the wild
899
CVEs
3
On KEV
9.8
Max CVSS
71
New 30D
Severity mix
Critical 50High 245Medium 205Low 0
Watch
Add ImageMagick to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-3714 In wildKEV | 8.4 | May 5 | ImageMagick Improper Input Validation Vulnerability Affected: through 6.9.3-9; 7.0.0-0; 7.0.1-0 |
| CVE-2016-3715 In wildKEV | 5.5 | May 5 | ImageMagick Arbitrary File Deletion Vulnerability Affected: before 6.9.3-10; 7.0.0-0; 7.0.1-0 |
| CVE-2016-3718 In wildKEV | 5.5 | May 5 | ImageMagick Server-Side Request Forgery (SSRF) Vulnerability Affected: before 6.9.3-10; 7.0.0-0; 7.0.1-0 |
| CVE-2026-25986 | 9.8 | Feb 24 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-40; 7.0.0-0 before 7.1.2-15 |
| CVE-2026-25983 | 9.8 | Feb 24 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-40; 7.0.0-0 before 7.1.2-15 |
| CVE-2026-25971 | 9.8 | Feb 24 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-40; 7.0.0-0 before 7.1.2-15 |
| CVE-2026-25968 | 9.8 | Feb 24 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-40; 7.0.0-0 before 7.1.2-15 |
| CVE-2026-25897 | 9.8 | Feb 24 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-40; 7.0.0-0 before 7.1.2-15 |
| CVE-2026-23876 | 9.8 | Jan 20 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-38; 7.0.0-0 before 7.1.2-13 |
| CVE-2026-22770 | 9.8 | Jan 20 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 7.1.2-13 |
| CVE-2025-57807 | 9.8 | Sep 5 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-29; 7.0.0-0 before 7.1.2-3 |
| CVE-2025-53101 | 9.8 | Jul 14 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-26; 7.0.0-0 before 7.1.2-0 |
| CVE-2025-53014 | 9.8 | Jul 14 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-26; 7.0.0-0 before 7.1.2-0 |
| CVE-2023-34152 | 9.8 | May 30 | A vulnerability was found in ImageMagick Affected: before 7.1.1-11 |
| CVE-2019-19952 | 9.8 | Dec 24 | In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to ReadOneMNGImage Affected: 7.0.8-61 before 7.0.9-7 |
| CVE-2019-19948 | 9.8 | Dec 24 | In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c Affected: 7.0.8-43 |
| CVE-2018-16329 | 9.8 | Sep 1 | In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c Affected: before 7.0.8-8 |
| CVE-2018-16328 | 9.8 | Sep 1 | In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c Affected: before 7.0.8-8 |
| CVE-2018-14551 | 9.8 | Jul 23 | The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption Affected: 7.0.8-7 |
| CVE-2017-18211 | 9.8 | Mar 1 | In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked,… Affected: 7.0.7-0; 7.0.7-1; 7.0.7-2; 7.0.7-3; 7.0.7-4; 7.0.7-5; +20 more |
| CVE-2017-18210 | 9.8 | Mar 1 | In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function BenchmarkOpenCLDevices in MagickCore/opencl.c because a memory allocation result is not… Affected: 7.0.7-0; 7.0.7-1; 7.0.7-2; 7.0.7-3; 7.0.7-4; 7.0.7-5; +20 more |
| CVE-2017-17499 | 9.8 | Dec 11 | ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp Affected: 7.0.0-0 before 7.0.7-12; before 6.9.9-24 |
| CVE-2017-15032 | 9.8 | Oct 5 | ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c Affected: 7.0.7-2 |
| CVE-2017-14626 | 9.8 | Sep 21 | ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c Affected: 7.0.7-0 |
| CVE-2017-14625 | 9.8 | Sep 21 | ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c Affected: 7.0.7-0 |
| CVE-2017-14624 | 9.8 | Sep 21 | ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c Affected: 7.0.7-0 |
| CVE-2017-14532 | 9.8 | Sep 18 | ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c Affected: 7.0.7-0 |
| CVE-2017-14138 | 9.8 | Sep 4 | ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by VP8 errors Affected: 7.0.6-5 |
| CVE-2017-13139 | 9.8 | Aug 23 | In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk Affected: through 6.9.9-0; 7.0.0-0; 7.0.1-0; 7.0.1-1; 7.0.1-2; 7.0.1-3; +34 more |
| CVE-2014-9826 | 9.8 | Mar 30 | ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files Affected: All versions, or not specified |
| CVE-2017-5511 | 9.8 | Mar 24 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow Affected: before 6.9.7-3; 7.0.0-0 before 7.0.4-3 |
| CVE-2016-10145 | 9.8 | Mar 24 | Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy Affected: before 6.9.7-1 |
| CVE-2016-10144 | 9.8 | Mar 24 | coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check Affected: before 6.9.7-1 |
| CVE-2014-9847 | 9.8 | Mar 20 | The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact Affected: 6.8.8-9 |
| CVE-2014-9846 | 9.8 | Mar 20 | Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact Affected: 6.8.8-9 |
| CVE-2014-9843 | 9.8 | Mar 20 | The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors Affected: 6.8.8-9 |
| CVE-2014-9841 | 9.8 | Mar 20 | The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to "throwing of exceptions." Affected: 6.8.8-9 |
| CVE-2014-9852 | 9.8 | Mar 17 | distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors Affected: before 6.9.4-0 |
| CVE-2016-5239 | 9.8 | Mar 15 | The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors Affected: through 6.9.3-9 |
| CVE-2016-5841 | 9.8 | Dec 13 | Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code… Affected: through 7.0.2-0 |
| CVE-2016-5691 | 9.8 | Dec 13 | The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1) pixel.red, (2)… Affected: through 6.9.4-4; 7.0.1-0; 7.0.1-1; 7.0.1-2; 7.0.1-3; 7.0.1-4; +2 more |
| CVE-2016-5690 | 9.8 | Dec 13 | The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact via vectors involving the for… Affected: through 6.9.4-4; 7.0.1-0; 7.0.1-1; 7.0.1-2; 7.0.1-3; 7.0.1-4; +2 more |
| CVE-2016-5689 | 9.8 | Dec 13 | The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of NULL pointer checks Affected: through 6.9.4-4; 7.0.1-0; 7.0.1-1; 7.0.1-2; 7.0.1-3; 7.0.1-4; +2 more |
| CVE-2016-5687 | 9.8 | Dec 13 | The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which… Affected: through 6.9.4-2; 7.0.1-0; 7.0.1-1; 7.0.1-2; 7.0.1-3 |
| CVE-2016-5118 | 9.8 | Jun 10 | The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a… Affected: before 7.0.1-7 |
| CVE-2016-4564 | 9.8 | Jun 4 | The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which… Affected: through 6.9.3-0; 7.0.0-0; 7.0.1-0; 7.0.1-1 |
| CVE-2026-56372 | 9.1 | Jul 11 | ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method Affected: before 7.1.2-19 |
| CVE-2026-56367 | 9.1 | Jun 21 | ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding Affected: 7.0.0 before 7.1.2-15; 6.9.0 before 6.9.13-40 |
| CVE-2026-26284 | 9.1 | Feb 24 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-40; 7.0.0-0 before 7.1.2-15 |
| CVE-2026-25987 | 9.1 | Feb 24 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-40; 7.0.0-0 before 7.1.2-15 |
The 500 most important CVEs for this product (exploited first, then by severity)