IM
Product
ImageMagick
On CISA KEVExploited in the wild
899
CVEs
3
On KEV
9.8
Max CVSS
71
New 30D
Severity mix
Critical 50High 245Medium 205Low 0
Watch
Add ImageMagick to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-7396 | 7.5 | Feb 5 | In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c Affected: before 6.9.10-25; 7.0.0-0 before 7.0.8-25 |
| CVE-2019-7398 | 7.5 | Feb 5 | In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c Affected: before 6.9.10-25; 7.0.0-0 before 7.0.8-25 |
| CVE-2017-15033 | 7.5 | Oct 5 | ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c Affected: 7.0.7-2 |
| CVE-2017-14739 | 7.5 | Sep 26 | The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which allows remote attackers to cause a… Affected: 7.0.7-4 |
| CVE-2017-14137 | 7.5 | Sep 4 | ReadWEBPImage in coders/webp.c in ImageMagick 7.0.6-5 has an issue where memory allocation is excessive because it depends only on a length field in a header Affected: 7.0.6-5 |
| CVE-2017-13143 | 7.5 | Aug 23 | In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive… Affected: through 6.9.7-5; 7.0.1-0; 7.0.1-1; 7.0.1-2; 7.0.1-3; 7.0.1-4; +34 more |
| CVE-2017-12435 | 7.5 | Aug 4 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service Affected: 7.0.6-1 |
| CVE-2017-12430 | 7.5 | Aug 4 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service Affected: 7.0.6-1 |
| CVE-2017-12429 | 7.5 | Aug 4 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service Affected: 7.0.6-1 |
| CVE-2017-12428 | 7.5 | Aug 4 | In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service in CloneDrawInfo in… Affected: 7.0.6-1 |
| CVE-2017-12418 | 7.5 | Aug 4 | ImageMagick 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c Affected: 7.0.6-5 |
| CVE-2016-7539 | 7.5 | Jul 25 | Memory leak in AcquireVirtualMemory in ImageMagick before 7 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors Affected: through 6.9.9-3 |
| CVE-2017-11188 | 7.5 | Jul 12 | The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF… Affected: 7.0.6-0 |
| CVE-2017-9098 | 7.5 | May 19 | ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory… Affected: before 6.9.8-1; 7.0.0-0 before 7.0.5-2 |
| CVE-2017-7619 | 7.5 | Apr 10 | In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms Affected: 7.0.4-9 |
| CVE-2014-9804 | 7.5 | Mar 30 | vision.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via vectors related to "too many object." Affected: before 6.9.4-0 |
| CVE-2017-5507 | 7.5 | Mar 24 | Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a… Affected: 7.0.1-0; 7.0.1-1; 7.0.1-2; 7.0.1-3; 7.0.1-4; 7.0.1-5; +32 more |
| CVE-2016-10146 | 7.5 | Mar 24 | Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors Affected: before 6.9.6-8 |
| CVE-2016-10048 | 7.5 | Mar 23 | Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors Affected: 6.9.4-7 |
| CVE-2014-9839 | 7.5 | Mar 22 | magick/colormap-private.h in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access) Affected: 6.8.9-9 |
| CVE-2014-9851 | 7.5 | Mar 20 | ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash) Affected: 6.8.8-9 |
| CVE-2014-9850 | 7.5 | Mar 20 | Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption) Affected: 6.8.8-9 |
| CVE-2014-9849 | 7.5 | Mar 20 | The png coder in ImageMagick allows remote attackers to cause a denial of service (crash) Affected: 6.8.8-9 |
| CVE-2014-9848 | 7.5 | Mar 20 | Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption) Affected: before 6.9.4-0 |
| CVE-2014-9842 | 7.5 | Mar 20 | Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors Affected: 6.8.8-9 |
| CVE-2014-9854 | 7.5 | Mar 17 | coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identification of image." Affected: before 6.9.4-0 |
| CVE-2015-8895 | 7.5 | Mar 15 | Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which… Affected: 6.9.1-3; 6.9.1-4; 6.9.1-5; 6.9.1-6; 6.9.1-7; 6.9.1-8; +34 more |
| CVE-2016-10252 | 7.5 | Mar 14 | Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used in ODR-PadEnc and other products, allows attackers to trigger memory… Affected: through 6.9.2-1 |
| CVE-2017-6497 | 7.5 | Mar 6 | An issue was discovered in ImageMagick 6.9.7 Affected: 6.9.7 |
| CVE-2016-10067 | 7.5 | Mar 2 | magick/memory.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via vectors involving "too many exceptions," which trigger a… Affected: through 6.9.4-4 |
| CVE-2016-6823 | 7.5 | Jan 18 | Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers… Affected: before 6.9.10-50; 7.0.0-0 before 7.0.2-10 |
| CVE-2016-5842 | 7.5 | Dec 13 | MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an… Affected: before 6.9.4-10; 7.0.0-0 before 7.0.2-1 |
| CVE-2012-1610 | 7.5 | Jun 5 | Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a… Affected: before 6.7.6-4 |
| CVE-2026-56374 | 7.1 | Jul 8 | ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter Affected: before 7.1.2-19 |
| CVE-2026-56361 | 7.1 | Jun 30 | ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing Affected: before 7.1.2-19; before 6.9.13-44 |
| CVE-2026-33905 | 7.1 | Apr 13 | ImageMagick has an Out-of-Bounds read via -sample operation Affected: < 7.1.2-19; < 6.9.13-44 |
| CVE-2026-28494 | 7.1 | Mar 9 | ImageMagick affected by stack corruption through long morphology kernel names or arrays Affected: >= 7.0.0, < 7.1.2-16; < 6.9.13-41 |
| CVE-2026-27798 | 7.1 | Feb 25 | ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images Affected: < 6.9.13-40; >= 7.0.0, < 7.1.2-15 |
| CVE-2022-48541 | 7.1 | Aug 22 | A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command Affected: 6.9.11-22; 7.0.10-45 |
| CVE-2022-0284 | 7.1 | Aug 29 | A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h' Affected: before 7.1.0-20 |
| CVE-2022-1114 | 7.1 | Apr 29 | A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file Affected: 6.0 before 6.9.12-43; 7.0.0-0 before 7.1.0-28 |
| CVE-2020-27752 | 7.1 | Dec 8 | A flaw was found in ImageMagick in MagickCore/quantum-private.h Affected: before 6.9.11-47; 7.0.0-0 before 7.0.9-0 |
| CVE-2020-13902 | 7.1 | Jun 7 | ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding Affected: 7.0.9-27 through 7.0.10-17 |
| CVE-2019-10131 | 7.1 | Apr 30 | An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c Affected: before 6.9.9-40; 7.0.0-0 before 7.0.7-28 |
| CVE-2026-108693 | 7.0 | Oct 11 | ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate Affected: 7.0.0-0 through 7.1.2-33; through 6.9.13-58 |
The 500 most important CVEs for this product (exploited first, then by severity)
