IM
Product
ImageMagick
On CISA KEVExploited in the wild
899
CVEs
3
On KEV
9.8
Max CVSS
71
New 30D
Severity mix
Critical 50High 245Medium 205Low 0
Watch
Add ImageMagick to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-9831 | 8.8 | Aug 7 | coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted wpg file Affected: before 6.9.4-0 |
| CVE-2014-9830 | 8.8 | Aug 7 | coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file Affected: before 6.9.4-0 |
| CVE-2014-9828 | 8.8 | Aug 7 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file Affected: before 6.9.4-0 |
| CVE-2014-9827 | 8.8 | Aug 7 | coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file Affected: before 6.9.4-0 |
| CVE-2017-12644 | 8.8 | Aug 7 | ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c Affected: 7.0.6-1 |
| CVE-2017-12642 | 8.8 | Aug 7 | ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders\mpc.c Affected: 7.0.6-1 |
| CVE-2017-12641 | 8.8 | Aug 7 | ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c Affected: 7.0.6-1 |
| CVE-2017-12640 | 8.8 | Aug 7 | ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c Affected: 7.0.6-1 |
| CVE-2017-12587 | 8.8 | Aug 6 | ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c Affected: 7.0.6-1 |
| CVE-2017-11450 | 8.8 | Jul 19 | coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via JPEG data that… Affected: before 6.9.9-0; 7.0.0-0 before 7.0.6-1 |
| CVE-2017-11449 | 8.8 | Jul 19 | coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attackers to cause a denial of service… Affected: before 6.9.9-0; 7.0.0-0 before 7.0.6-1 |
| CVE-2017-11310 | 8.8 | Jul 13 | The read_user_chunk_callback function in coders\png.c in ImageMagick 7.0.6-1 Q16 2017-06-21 (beta) has memory leak vulnerabilities via crafted PNG files Affected: 7.0.6-1 |
| CVE-2017-11170 | 8.8 | Jul 11 | The ReadTGAImage function in coders\tga.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via invalid colors data in the header of a TGA or… Affected: 7.0.5-6 |
| CVE-2017-10928 | 8.8 | Jul 5 | In ImageMagick 7.0.6-0, a heap-based buffer over-read in the GetNextToken function in token.c allows remote attackers to obtain sensitive information from process memory or… Affected: 7.0.6-0 |
| CVE-2016-8677 | 8.8 | Feb 15 | The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers… Affected: before 6.9.5-10; 7.0.0-0 before 7.0.3-1 |
| CVE-2016-8866 | 8.8 | Feb 15 | The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which… Affected: before 6.9.6-6; 7.0.0-0 through 7.0.3-7 |
| CVE-2016-8862 | 8.8 | Feb 15 | The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick before 7.0.3.3 allows remote attackers to have unspecified impact via a crafted image, which triggers a… Affected: before 6.9.4-0; 7.0.0-0 before 7.0.3-3 |
| CVE-2016-6491 | 8.8 | Dec 13 | Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service… Affected: through 6.9.5-3; 7.0.1-0; 7.0.1-1; 7.0.1-2; 7.0.1-3; 7.0.1-4; +12 more |
| CVE-2016-4563 | 8.8 | Jun 4 | The TraceStrokePolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles the relationship between the BezierQuantum value and certain… Affected: through 6.9.3-0; 7.0.0-0; 7.0.1-0; 7.0.1-1 |
| CVE-2016-4562 | 8.8 | Jun 4 | The DrawDashPolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles calculations of certain vertices integer data, which allows… Affected: through 6.9.3-0; 7.0.0-0; 7.0.1-0; 7.0.1-1 |
| CVE-2012-0247 | 8.8 | Jun 5 | ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in… Affected: through 6.7.5-7 |
| CVE-2026-106580 | 8.2 | Oct 7 | ImageMagick: Policy Bypass in CUT encoder Affected: < 6.9.13-56; >= 7.0.0, < 7.1.2-31 |
| CVE-2026-56378 | 8.2 | Jun 21 | ImageMagick - Heap Out-of-Bounds Read in PCD Decoder Affected: before 7.1.2-15; before 6.9.13-40 |
| CVE-2026-25794 | 8.2 | Feb 24 | ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensions Affected: < 7.1.2-15 |
| CVE-2026-116149 New | 8.1 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images Affected: 7.0.0-0 before 7.1.2-33; before 6.9.13-58 |
| CVE-2026-56379 | 8.1 | Jun 23 | ImageMagick - Command Injection via SVG Decoder Affected: before 7.1.2-15; before 6.9.13-40 |
| CVE-2026-28693 | 8.1 | Mar 9 | ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write Affected: >= 7.0.0, < 7.1.2-16; < 6.9.13-41 |
| CVE-2019-11598 | 8.1 | Apr 29 | In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or… Affected: 7.0.8-40 |
| CVE-2019-11597 | 8.1 | Apr 29 | In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or… Affected: 7.0.8-43 |
| CVE-2019-10650 | 8.1 | Mar 30 | In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or… Affected: 7.0.8-36 |
| CVE-2017-14607 | 8.1 | Sep 20 | In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c Affected: 7.0.7-4 |
| CVE-2016-5688 | 8.1 | Dec 13 | The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the… Affected: through 6.9.4-3; 7.0.1-0; 7.0.1-1; 7.0.1-2; 7.0.1-3; 7.0.1-4 |
| CVE-2026-56370 | 7.8 | Jun 24 | ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact Affected: before 7.1.2-19; before 6.9.13-44 |
| CVE-2026-30931 | 7.8 | Mar 9 | ImageMagick has a heap-based buffer overflow in UHDR encoder Affected: < 7.1.2-16 |
| CVE-2026-30929 | 7.8 | Mar 9 | ImageMagick has a stack buffer overflow in MagnifyImage Affected: >= 7.0.0, < 7.1.2-16; < 6.9.13-41 |
| CVE-2026-30883 | 7.8 | Mar 9 | ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder Affected: >= 7.0.0, < 7.1.2-16; < 6.9.13-41 |
| CVE-2026-25966 | 7.8 | Feb 24 | ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2025-55154 | 7.8 | Aug 13 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-27; 7.0.0-0 before 7.1.2-1 |
| CVE-2024-41817 | 7.8 | Jul 29 | ImageMagick is a free and open-source software suite, used for editing and manipulating digital images Affected: 7.0.11-13 before 7.1.1-36 |
| CVE-2023-34153 | 7.8 | May 30 | A vulnerability was found in ImageMagick Affected: 7.1.0-1 before 7.1.1-11 |
| CVE-2022-32547 | 7.8 | Jun 16 | In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at… Affected: before 6.9.12-45; 7.1.0-0 before 7.1.0-30 |
| CVE-2022-32546 | 7.8 | Jun 16 | A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is… Affected: before 6.9.12-44; 7.1.0 before 7.1.0-29 |
| CVE-2022-32545 | 7.8 | Jun 16 | A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is… Affected: before 6.9.12-43; 7.1.0 before 7.1.0-28 |
| CVE-2022-28463 | 7.8 | May 8 | ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow Affected: 6.9.4-0 before 6.9.12-44; 7.0.1-0 before 7.1.0-29 |
| CVE-2021-3962 | 7.8 | Nov 19 | A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes Affected: 7.1.0-14 |
| CVE-2020-29599 | 7.8 | Dec 7 | ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files Affected: 6.9.8-1 before 6.9.11-40; 7.0.5-3 before 7.0.10-40 |
| CVE-2020-27766 | 7.8 | Dec 4 | A flaw was found in ImageMagick in MagickCore/statistic.c Affected: before 6.9.10-69; 7.0.0-0 before 7.0.8-69 |
| CVE-2020-19667 | 7.8 | Nov 20 | Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7 Affected: 7.0.10-7 |
| CVE-2014-1947 | 7.8 | Feb 17 | Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and… Affected: through 6.5.4 |
| CVE-2019-13307 | 7.8 | Jul 5 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows Affected: 7.0.8-50 |
The 500 most important CVEs for this product (exploited first, then by severity)