IM
Product
ImageMagick
On CISA KEVExploited in the wild
899
CVEs
3
On KEV
9.8
Max CVSS
71
New 30D
Severity mix
Critical 50High 245Medium 205Low 0
Watch
Add ImageMagick to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-1947 | 7.8 | Feb 17 | Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and… Affected: through 6.5.4 |
| CVE-2019-13307 | 7.8 | Jul 5 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows Affected: 7.0.8-50 |
| CVE-2019-13306 | 7.8 | Jul 5 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors Affected: 7.0.8-50 |
| CVE-2019-13305 | 7.8 | Jul 5 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error Affected: 7.0.8-50 |
| CVE-2019-13304 | 7.8 | Jul 5 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment Affected: 7.0.8-50 |
| CVE-2019-13136 | 7.8 | Jul 1 | ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c Affected: before 7.0.8-50 |
| CVE-2019-12979 | 7.8 | Jun 26 | ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c Affected: 7.0.8-34 |
| CVE-2019-12978 | 7.8 | Jun 26 | ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c Affected: 7.0.8-34 |
| CVE-2019-12977 | 7.8 | Jun 26 | ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c Affected: 7.0.8-34 |
| CVE-2014-9825 | 7.8 | Mar 30 | Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9824 Affected: before 6.9.4-0 |
| CVE-2014-9824 | 7.8 | Mar 30 | Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9825 Affected: before 6.9.4-0 |
| CVE-2014-9823 | 7.8 | Mar 30 | Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9819 Affected: before 6.9.4-0 |
| CVE-2014-9822 | 7.8 | Mar 30 | Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted quantum file Affected: before 6.9.4-0 |
| CVE-2014-9821 | 7.8 | Mar 30 | Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file Affected: before 6.9.4-0 |
| CVE-2014-9820 | 7.8 | Mar 30 | Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pnm file Affected: before 6.9.4-0 |
| CVE-2014-9819 | 7.8 | Mar 30 | Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9823 Affected: before 6.9.4-0 |
| CVE-2014-9817 | 7.8 | Mar 30 | Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pdb file Affected: before 6.9.4-0 |
| CVE-2017-5510 | 7.8 | Mar 24 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write Affected: before 6.9.7-4; 7.0.0-0 before 7.0.4-4 |
| CVE-2017-5509 | 7.8 | Mar 24 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write Affected: before 6.9.7-4; 7.0.0-0 before 7.0.4-4 |
| CVE-2017-5506 | 7.8 | Mar 24 | Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file Affected: All versions, or not specified |
| CVE-2016-10059 | 7.8 | Mar 23 | Buffer overflow in coders/tiff.c in ImageMagick before 6.9.4-1 allows remote attackers to cause a denial of service (application crash) or have unspecified other impact via a… Affected: through 6.9.4-0 |
| CVE-2016-10057 | 7.8 | Mar 23 | Buffer overflow in the WriteGROUP4Image function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have… Affected: through 6.9.5-7 |
| CVE-2016-10056 | 7.8 | Mar 23 | Buffer overflow in the sixel_decode function in coders/sixel.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other… Affected: through 6.9.5-7 |
| CVE-2016-10055 | 7.8 | Mar 23 | Buffer overflow in the WritePDBImage function in coders/pdb.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other… Affected: through 6.9.5-7 |
| CVE-2016-10054 | 7.8 | Mar 23 | Buffer overflow in the WriteMAPImage function in coders/map.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other… Affected: through 6.9.5-7 |
| CVE-2016-10052 | 7.8 | Mar 23 | Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of service (application crash) or have other… Affected: through 6.9.5-5 |
| CVE-2016-10051 | 7.8 | Mar 23 | Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have… Affected: 6.9.5-5 |
| CVE-2016-10050 | 7.8 | Mar 23 | Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have… Affected: 6.9.4-8 |
| CVE-2016-10049 | 7.8 | Mar 23 | Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other… Affected: through 6.9.4-3 |
| CVE-2014-9835 | 7.8 | Mar 22 | Heap overflow in ImageMagick 6.8.9-9 via a crafted wpf file Affected: 6.8.9-9 |
| CVE-2014-9834 | 7.8 | Mar 22 | Heap overflow in ImageMagick 6.8.9-9 via a crafted pict file Affected: 6.8.9-9 |
| CVE-2014-9833 | 7.8 | Mar 22 | Heap overflow in ImageMagick 6.8.9-9 via a crafted psd file Affected: 6.8.9-9 |
| CVE-2014-9832 | 7.8 | Mar 22 | Heap overflow in ImageMagick 6.8.9-9 via a crafted pcx file Affected: 6.8.9-9 |
| CVE-2016-10065 | 7.8 | Mar 3 | The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact… Affected: through 6.9.7-10 |
| CVE-2016-10064 | 7.8 | Mar 2 | Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a… Affected: through 6.9.5-0 |
| CVE-2016-10063 | 7.8 | Mar 2 | Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a… Affected: through 6.9.5-0 |
| CVE-2016-8707 | 7.8 | Dec 23 | An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility Affected: 7.0.3-1 |
| CVE-2012-1185 | 7.8 | Jun 5 | Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory… Affected: through 6.7.5 |
| CVE-2007-4988 | 7.8 | Sep 24 | Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image… Affected: before 6.3.5-9 |
| CVE-2026-107209 | 7.5 | Oct 7 | ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support Affected: < 6.9.13-55; >= 7.0.0, < 7.1.2-30 |
| CVE-2026-106579 | 7.5 | Oct 7 | ImageMagick: Policy Bypass when using coder as the domain. Affected: < 6.9.13-56; >= 7.0.0, < 7.1.2-31 |
| CVE-2026-106578 | 7.5 | Oct 7 | ImageMagick: Invalid Memory Free in MVG decoder Affected: < 6.9.13-56; >= 7.0.0, < 7.1.2-31 |
| CVE-2026-106576 | 7.5 | Oct 7 | ImageMagick: Denial of service possible when parsing an XMP profile. Affected: < 7.1.2-31 |
| CVE-2026-106573 | 7.5 | Oct 7 | ImageMagick: Denial of service in MVG decoder Affected: < 6.9.13-56; >= 7.0.0, < 7.1.2-31 |
| CVE-2026-106567 | 7.5 | Oct 7 | ImageMagick: Infinite Loop in PSD decoder on 32-bit builds Affected: < 6.9.13-57; >= 7.0.0, < 7.1.2-32 |
| CVE-2026-106565 | 7.5 | Oct 7 | ImageMagick: Infinite Loop in bzip2 compressed images. Affected: < 6.9.13-57; >= 7.0.0, < 7.1.2-32 |
| CVE-2026-93590 | 7.5 | Sep 18 | ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder Affected: before 7.1.2-31 |
| CVE-2026-93589 | 7.5 | Sep 18 | ImageMagick before 7.1.2-31 Division by Zero in FLIF encoder Affected: before 7.1.2-31; before 6.9.13-56 |
| CVE-2026-86421 | 7.5 | Sep 7 | ImageMagick before 7.1.2-30 Memory Leak via MSL decoder Affected: before 7.1.2-30; before 6.9.13-55 |
| CVE-2026-86420 | 7.5 | Sep 7 | ImageMagick before 7.1.2-30 Denial of Service Memory Budget Affected: before 7.1.2-30; before 6.9.13-55 |
The 500 most important CVEs for this product (exploited first, then by severity)