ImageMagick
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in ImageMagick.
Known Exploited ImageMagick Vulnerabilities
The following ImageMagick vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| ImageMagick Improper Input Validation Vulnerability |
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image. CVE-2016-3714 Exploit Probability: 97.5% |
September 9, 2024 |
| ImageMagick Ephemeral Coder Arbitrary File Deletion Vulnerability |
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. CVE-2016-3715 Exploit Probability: 75.4% |
November 3, 2021 |
| ImageMagick SSRF Vulnerability |
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. CVE-2016-3718 Exploit Probability: 76.9% |
November 3, 2021 |
Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.
By the Year
In 2026 there have been 131 vulnerabilities in ImageMagick with an average score of 5.6 out of ten. Last year, in 2025 Imagemagick had 22 security vulnerabilities published. That is, 109 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.06
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 131 | 5.56 |
| 2025 | 22 | 5.62 |
| 2024 | 3 | 7.65 |
| 2023 | 16 | 6.11 |
| 2022 | 15 | 6.54 |
| 2021 | 16 | 4.70 |
| 2020 | 40 | 4.54 |
| 2019 | 64 | 7.06 |
| 2018 | 60 | 7.24 |
It may take a day or so for new Imagemagick vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent ImageMagick Security Vulnerabilities
ImageMagick <=7.1.2-26 VIFF Encoder Mem Leak (CVE-2026-61870)
CVE-2026-61870
2.9 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
Memory Leak
ImageMagick <=7.1.2-26 UAF in FormatMagickCaption (DoS/Exec)
CVE-2026-61861
3.7 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.
Dangling pointer
ImageMagick <7.1.2-26 APNG encoder policy bypass
CVE-2026-61858
3.3 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.
insecure temporary file
ImageMagick <7.1.2-26 Heap UAF via XMP Parsing
CVE-2026-61857
3.7 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.
Unchecked Return Value
ImageMagick <7.1.2-26 memory overalloc in matrix ops (-canny)
CVE-2026-61465
3.3 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.
Allocation of Resources Without Limits or Throttling
ImageMagick <=7.1.2-19 Magnify OOB Read Heap Buffer Overflow
CVE-2026-56372
3.3 - Low
- July 11, 2026
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.
Heap-based Buffer Overflow
ImageMagick use-after-free in PDB decoder before 7.1.2-15
CVE-2026-56373
3.7 - Low
- July 10, 2026
ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.
Dangling pointer
ImageMagick <7.1.2-18 Memory Leak in META Reader (APP1JPEG)
CVE-2026-56366
3.3 - Low
- July 10, 2026
ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.
Memory Leak
ImageMagick <7.1.2-19 Heap Buffer Overflow in FTXT Encoder
CVE-2026-56374
3.3 - Low
- July 08, 2026
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of service or information disclosure.
Out-of-bounds Read
ImageMagick <7.1.2-15 Heap BOV Read via GetPixelIndex
CVE-2026-56362
3.3 - Low
- July 08, 2026
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting any writer calling GetPixelIndex.
Out-of-bounds Read
ImageMagick before 7.1.2-26 JP2 Encoder Heap Buffer Overwrite
CVE-2026-55597
5.5 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.
Incorrect Calculation
ImageMagick 6.9.13-51/7.1.2-26 Infinite Loop via connected-components
CVE-2026-55595
4.7 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Resource Exhaustion
ImageMagick <6.9.13-51/<7.1.2-26: MVG Decoder Stack Overflow
CVE-2026-55594
5.3 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Resource Exhaustion
ImageMagick MVG Heap Buffer Overflow before 7.1.2-26
CVE-2026-55577
5.9 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Improper Check for Unusual or Exceptional Conditions
ImageMagick UAF via crafted 8BIM format string before 6.9.13-51/7.1.2-26
CVE-2026-55510
5.5 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Dangling pointer
ImageMagick MNG Decoder Heap Info Disclosure (before 6.9.13-51/7.1.2-26)
CVE-2026-53467
5.3 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Use of Uninitialized Resource
ImageMagick XCF decoder integer overflow before 6.9.13-51 & 7.1.2-26
CVE-2026-53466
6.5 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Integer Overflow or Wraparound
Missing policy checks in -concatenate operation before 7.1.2-26 (fixed)
CVE-2026-55628
5.5 - Medium
- July 01, 2026
In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.
External Control of File Name or Path
ImageMagick <=7.1.2-24 arbitrary file write via policy check flaw
CVE-2026-56377
3.3 - Low
- June 30, 2026
ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.
Directory traversal
ImageMagick <7.1.2-22: PasskeyEncipherImage AES-CTR Nonce Reuse Disclosure
CVE-2026-56369
3.7 - Low
- June 30, 2026
ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.
Reusing a Nonce, Key Pair in Encryption
ImageMagick <=7.1.2-18 PNG Encoder Memory Leak (PNG MNG)
CVE-2026-56365
3.7 - Low
- June 30, 2026
ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.
Memory Leak
ImageMagick 7.1.2-13 Memory Leak in LoadOpenCLDeviceBenchmark()
CVE-2026-56364
1.9 - Low
- June 30, 2026
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.
Memory Leak
ImageMagick <7.1.2-22 Division By Zero in Binomial Kernel (DoS)
CVE-2026-56363
3.3 - Low
- June 30, 2026
ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash.
Integer Overflow or Wraparound
ImageMagick <7.1.2-19 OOB HEAP read via morphology off-by-one
CVE-2026-56361
3.3 - Low
- June 30, 2026
ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations.
Out-of-bounds Read
ImageMagick 7.1.2-19 OOB in ConnectedComponentsImage CLI
CVE-2026-56370
3.3 - Low
- June 24, 2026
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution.
Out-of-bounds Read
ImageMagick <7.1.2-15 memory leak in raw pixel coders -> DoS
CVE-2026-56368
3.7 - Low
- June 24, 2026
ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.
Memory Leak
ImageMagick SVG decoder command injection (pre 7.1.2-15 / pre 6.9.13-40)
CVE-2026-56379
8.1 - High
- June 23, 2026
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
Output Sanitization
ImageMagick <7.1.2-15,6.9.13-40: heap use-after-free in meta coder leads to DoS
CVE-2026-56376
3.7 - Low
- June 23, 2026
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service.
Dangling pointer
ImageMagick <=7.1.2-15, 6.9.13-40: TXT coder memory leak via texture attributes
CVE-2026-56371
5.3 - Medium
- June 23, 2026
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed.
Memory Leak
ImageMagick <=7.1.2-15 Heap OOB Read in PCD Decoder
CVE-2026-56378
3.7 - Low
- June 21, 2026
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.
Out-of-bounds Read
ImageMagick <7.1.2-15, 6.9.13-40: PSB RLE Integer Overflow (OOB Read)
CVE-2026-56367
3.7 - Low
- June 21, 2026
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash.
Out-of-bounds Read
ImageMagick 7.1.2-25 SF3 Encoder Heap Buffer Overwrite in Prior Versions
CVE-2026-53465
6.2 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, a crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder. This issue has been patched in version 7.1.2-25.
Heap-based Buffer Overflow
ImageMagick 7.1.2-25 Memory Leak in Wand Option Parser (CVE-2026-53464)
CVE-2026-53464
4 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, when providing invalid options to the wand option parser a small memory leak will occur. This issue has been patched in version 7.1.2-25.
Memory Leak
ImageMagick NPE on Distort op prior to 6.9.13-50/7.1.2-25
CVE-2026-53463
4.3 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when passing incorrect arguments in the distort operation a null pointer deference will occur. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.
NULL Pointer Dereference
ImageMagick pre-6.9.13-50/7.1.2-25 heap-use-after-free CheckPrimitiveExtent
CVE-2026-53462
5.9 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.
Dangling pointer
ImageMagick 7.x ICON Decoder: OOB Heap Write (7.1.2-24)
CVE-2026-53461
7.5 - High
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.
Memory Corruption
ImageMagick OOM in AcquireAlignedMemory (pre-6.9.13-50/7.1.2-25)
CVE-2026-53460
7.5 - High
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.
Allocation of Resources Without Limits or Throttling
ImageMagick 6.9.13-48/7.1.2-24: Filename Parsing Bypass via Symlink Read
CVE-2026-49219
5.5 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.
Directory traversal
Invalid DCM decode in ImageMagick <6.9.13-48 / <7.1.2-24 causes crash
CVE-2026-49218
7.5 - High
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.
Improper Input Validation
ImageMagick 6.9.13-48/7.1.2-24 MAT Decoder Heap Buffer Overwrite 32bit
CVE-2026-48994
5.9 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.
Heap-based Buffer Overflow
ImageMagick CVE-2026-48734: MVG Stack Overflow Pre v6.9.13-49/7.1.2-24
CVE-2026-48734
5.5 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. This issue has been patched in versions 6.9.13-49 and 7.1.2-24.
Stack Exhaustion
ImageMagick <6.9.13-49 & <7.1.2-24: Infinite Loop in Subimage-Search
CVE-2026-48733
4.7 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in the subimage-search operation can happen when using a crafted image. This issue has been patched in versions 6.9.13-49 and 7.1.2-24.
Infinite Loop
ImageMagick <7.1.2-24 Heap Buffer Overwrite via FloydSteinberg Dithering
CVE-2026-48724
5.5 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-24, when using an image with mask the Floyd-Steinberg dithering method it will cause a negative heap buffer over-write. This issue has been patched in version 7.1.2-24.
Memory Corruption
ImageMagick heap buffer over-read via -distribute-cache (pre-6.9.13-48/7.1.2-23)
CVE-2026-47166
5.7 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
Out-of-bounds Read
ImageMagick Pixel Cache Auth Bypass (6.9.13-47, 7.1.2-22)
CVE-2026-47165
4.1 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challengeresponse authentication model. This has been changed in versions 6.9.13-48 and 7.1.2-23.
Information Disclosure
ImageMagick < 6.9.13-48/7.1.2-23: FD Hijack via race in magick-distribute-cache
CVE-2026-46693
4.1 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
Race Condition
ImageMagick 6.9.13-47 Heap Buffer OVR via magick -distribute-cache
CVE-2026-46692
4.1 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
Heap-based Buffer Overflow
ImageMagick <6.9.13-48 & <7.1.2-23: JP2 Buffer Overwrite in Heap
CVE-2026-46559
4 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
off-by-five
ImageMagick FX Stack Overflow via Missing Depth Check (v<7.1.2-23)
CVE-2026-46557
6.2 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-23, due to a missing depth check a stack overflow can occur in the fx operation by passing a crafted argument. This issue has been patched in version 7.1.2-23.
Stack Exhaustion
ImageMagick MIFF LZMA OOB Write Before 6.9.13-48 / 7.1.2-23
CVE-2026-46521
5.5 - Medium
- June 10, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.
Incorrect Calculation of Buffer Size
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for ImageMagick or by ImageMagick? Click the Watch button to subscribe.
