IM
Product
ImageMagick
On CISA KEVExploited in the wild
899
CVEs
3
On KEV
9.8
Max CVSS
71
New 30D
Severity mix
Critical 50High 245Medium 205Low 0
Watch
Add ImageMagick to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-61870 | 7.5 | Jul 11 | ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder Affected: before 7.1.2-26; before 6.9.13-51 |
| CVE-2026-61861 | 7.5 | Jul 11 | ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption Affected: before 7.1.2-26; before 6.9.13-51 |
| CVE-2026-61857 | 7.5 | Jul 11 | ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP Affected: before 7.1.2-26; before 6.9.13-51 |
| CVE-2026-56368 | 7.5 | Jun 24 | ImageMagick - Memory Leak in Raw Pixel Data Coders Affected: before 7.1.2-15; before 6.9.13-40 |
| CVE-2026-53461 | 7.5 | Jun 10 | ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop Affected: < 6.9.13-50; < 7.1.2-25 |
| CVE-2026-53460 | 7.5 | Jun 10 | ImageMagick: Policy Bypass can trigger out-of-Memory condition Affected: < 6.9.13-50; < 7.1.2-25 |
| CVE-2026-49218 | 7.5 | Jun 10 | ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions Affected: < 6.9.13-48; < 7.1.2-24 |
| CVE-2026-46520 | 7.5 | Jun 10 | ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions Affected: < 6.9.13-48; < 7.1.2-23 |
| CVE-2026-46522 | 7.5 | Jun 10 | ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion Affected: < 7.1.2-23; < 6.9.13-48 |
| CVE-2026-33908 | 7.5 | Apr 13 | ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree() Affected: < 6.9.13-44; < 7.1.2-19 |
| CVE-2026-33901 | 7.5 | Apr 13 | ImageMagick has a Heap Buffer Overflow via MVG decoder Affected: < 7.1.2-19; < 6.9.13-44 |
| CVE-2026-33900 | 7.5 | Apr 13 | ImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds Affected: < 6.9.13-44; < 7.1.2-19 |
| CVE-2026-32636 | 7.5 | Mar 18 | ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash Affected: < 6.9.13-42; < 7.1.2-17 |
| CVE-2026-28691 | 7.5 | Mar 9 | ImageMagick has an uninitialized pointer dereference in JBIG decoder Affected: >= 7.0.0, < 7.1.2-16; < 6.9.13-41 |
| CVE-2026-26283 | 7.5 | Feb 24 | ImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent` Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-26066 | 7.5 | Feb 24 | ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-25989 | 7.5 | Feb 24 | ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-25988 | 7.5 | Feb 24 | ImageMagick's MSL image stack index not refreshed, leading to leaked images. Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-25985 | 7.5 | Feb 24 | Memory allocation with excessive without limits in the internal SVG decoder Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-25970 | 7.5 | Feb 24 | ImageMagick SIXEL Decoder Has Signed Integer Overflow, Leading to Memory Corruption Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-25969 | 7.5 | Feb 24 | ImageMagick has Memory Leak in coders/ashlar.c Affected: < 7.1.2-15 |
| CVE-2026-25967 | 7.5 | Feb 24 | ImageMagick has stack buffer overflow in FTXT reader via oversized integer field Affected: < 7.1.2-15 |
| CVE-2026-25965 | 7.5 | Feb 24 | ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-25799 | 7.5 | Feb 24 | ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-25798 | 7.5 | Feb 24 | ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-25796 | 7.5 | Feb 24 | ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-25795 | 7.5 | Feb 24 | ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c) Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-24485 | 7.5 | Feb 24 | ImageMagick: Infinite loop vulnerability when parsing a PCD file Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-24481 | 7.5 | Feb 24 | ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression Affected: >= 7.0.0, < 7.1.2-15; < 6.9.13-40 |
| CVE-2026-23952 | 7.5 | Jan 22 | ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load Affected: < 14.10.2 |
| CVE-2025-69204 | 7.5 | Dec 30 | ImageMagick converting a malicious MVG file to SVG caused an integer overflow. Affected: < 7.1.2-12 |
| CVE-2025-68618 | 7.5 | Dec 30 | Magick's failure to limit the depth of SVG file reads caused a DoS attack. Affected: < 7.1.2-12 |
| CVE-2025-66628 | 7.5 | Dec 10 | ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only) Affected: < 7.1.2-10 |
| CVE-2025-62171 | 7.5 | Oct 17 | ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems Affected: < 6.9.13-32; >= 7.0.0-0, < 7.1.2-7 |
| CVE-2025-55212 | 7.5 | Aug 26 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-28; 7.0.0-0 before 7.1.2-2 |
| CVE-2025-53019 | 7.5 | Jul 14 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: before 6.9.13-26; 7.0.0-0 before 7.1.2-0 |
| CVE-2025-53015 | 7.5 | Jul 14 | ImageMagick is free and open-source software used for editing and manipulating digital images Affected: 7.1.1-7 before 7.1.2-0 |
| CVE-2025-43965 | 7.5 | Apr 23 | In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used Affected: before 7.1.1-44 |
| CVE-2021-40211 | 7.5 | Aug 22 | An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c Affected: 7.1.0-4 |
| CVE-2021-3610 | 7.5 | Feb 24 | A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c Affected: 6.9.10.88 before 6.9.12-14; 7.0.0-0 before 7.0.11-14 |
| CVE-2021-20313 | 7.5 | May 11 | A flaw was found in ImageMagick in versions before 7.0.11 Affected: before 7.0.11-0 |
| CVE-2021-20312 | 7.5 | May 11 | A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file… Affected: before 7.0.11-0 |
| CVE-2021-20311 | 7.5 | May 11 | A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a… Affected: before 7.0.11-0 |
| CVE-2021-20310 | 7.5 | May 11 | A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted… Affected: before 7.0.11-0 |
| CVE-2021-20309 | 7.5 | May 11 | A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior… Affected: before 6.9.12; 7.0.0-0 before 7.0.11-0 |
| CVE-2017-12806 | 7.5 | May 9 | In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service Affected: 7.0.6-6 |
| CVE-2017-12805 | 7.5 | May 9 | In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service Affected: 7.0.6-6 |
| CVE-2019-7175 | 7.5 | Mar 7 | In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c Affected: before 6.9.10-25; 7.0.0-0 before 7.0.8-25 |
| CVE-2019-7397 | 7.5 | Feb 5 | In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c Affected: before 6.9.10-25; 7.0.0-0 before 7.0.8-25 |
| CVE-2019-7395 | 7.5 | Feb 5 | In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c Affected: before 6.9.10-25; 7.0.0-0 before 7.0.8-25 |
The 500 most important CVEs for this product (exploited first, then by severity)
