ImageMagick
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in ImageMagick.
Known Exploited ImageMagick Vulnerabilities
The following ImageMagick vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| ImageMagick Improper Input Validation Vulnerability |
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image. CVE-2016-3714 Exploit Probability: 97.5% |
September 9, 2024 |
| ImageMagick Ephemeral Coder Arbitrary File Deletion Vulnerability |
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. CVE-2016-3715 Exploit Probability: 75.4% |
November 3, 2021 |
| ImageMagick SSRF Vulnerability |
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. CVE-2016-3718 Exploit Probability: 76.9% |
November 3, 2021 |
Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.
By the Year
In 2026 there have been 150 vulnerabilities in ImageMagick with an average score of 5.3 out of ten. Last year, in 2025 Imagemagick had 22 security vulnerabilities published. That is, 128 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.33
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 150 | 5.29 |
| 2025 | 22 | 5.62 |
| 2024 | 3 | 7.65 |
| 2023 | 16 | 6.11 |
| 2022 | 15 | 6.54 |
| 2021 | 16 | 4.70 |
| 2020 | 40 | 4.54 |
| 2019 | 64 | 7.06 |
| 2018 | 60 | 7.24 |
It may take a day or so for new Imagemagick vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent ImageMagick Security Vulnerabilities
ImageMagick 6.x/7.x Int Ovflw in 32-bit JNX File (Fixed 6.9.13-52/7.1.2-27)
CVE-2026-62946
5.1 - Medium
- July 30, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This issue has been fixed in versions 6.9.13-52 and 7.1.2-27.
Integer Overflow or Wraparound
ImageMagick <7.1.2-27 Heap Buffer Overwrite in fx Operation
CVE-2026-62363
5 - Medium
- July 30, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27.
Memory Corruption
ImageMagick Heap Overflow in Morphology via Invalid Kernel (Fixes <6.9.13-51, <7.1.2-26)
CVE-2026-62343
4.7 - Medium
- July 29, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Integer Overflow or Wraparound
ImageMagick 7.1.2-27 BGR Decoder Heap Over-Read
CVE-2026-64685
5.3 - Medium
- July 29, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version 7.1.2-27.
Out-of-bounds Read
ImageMagick 7.1.2-27 Memory Leak in magick CLI: Exploit via Malformed Args
CVE-2026-66011
3.3 - Low
- July 25, 2026
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.
Memory Leak
ImageMagick 7.1.2-26 &6.9.13-51 mem-leak via tiff:tile-geometry
CVE-2026-61872
2.5 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption.
Memory Leak
ImageMagick < 7.1.2-26 Memory Leak ICON Decoder (DoS)
CVE-2026-61871
3.7 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.
Memory Leak
ImageMagick DoS via Memory Leak in MIFF Encoder (pre 7.1.2-26, 6.9.13-51)
CVE-2026-61869
2.9 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
Memory Leak
ImageMagick 7.1.2-26/6.9.x YUV Decoder Memory Leak (CVE-2026-61868)
CVE-2026-61868
3.7 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).
Memory Leak
ImageMagick <7.1.2-26: TIFF Encoder Memory Leak (DoS)
CVE-2026-61867
2.9 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.
Memory Leak
ImageMagick JNG Encoder Memory Leak before 7.1.2-26
CVE-2026-61866
2.9 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG files that fail blob operations, causing resource exhaustion.
Memory Leak
ImageMagick <7.1.2-26 Hough Las Memory Leak
CVE-2026-61865
2.9 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memory leak occurs.
Memory Leak
ImageMagick 7.1.2-26 mem-leak in log colorspace transform (CVE-2026-61864)
CVE-2026-61864
2.9 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released.
Memory Leak
ImageMagick TIFF encoder memory leak <7.1.2-26, <6.9.13-51
CVE-2026-61863
2.9 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak.
Memory Leak
ImageMagick <7.1.2-26/6.9.13-51 Debug Info Disclosure in Identify
CVE-2026-61862
2.9 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the profile boundary). This behavior occurs when debug output is enabled.
Out-of-bounds Read
ImageMagick 7.1.2-26/6.9.13-51 UAF on Freetype init -> DoS
CVE-2026-61860
3.7 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service.
Dangling pointer
ImageMagick 7.1.2-26 & 6.9.13-51 Policy Bypass via -script Op
CVE-2026-61859
3.3 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy.
insecure temporary file
ImageMagick <7.1.2-26/6.9.13-51 Heap Overwrite via X11 Title
CVE-2026-61464
1.8 - Low
- July 15, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service.
Heap-based Buffer Overflow
ImageMagick 7.1.2-18 ASHLAR Coder Mem Leak DoS
CVE-2026-56375
3.3 - Low
- July 15, 2026
ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and cause denial of service.
Memory Leak
ImageMagick <=7.1.2-26 VIFF Encoder Mem Leak (CVE-2026-61870)
CVE-2026-61870
2.9 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
Memory Leak
ImageMagick <=7.1.2-26 UAF in FormatMagickCaption (DoS/Exec)
CVE-2026-61861
3.7 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.
Dangling pointer
ImageMagick <7.1.2-26 APNG encoder policy bypass
CVE-2026-61858
3.3 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.
insecure temporary file
ImageMagick <7.1.2-26 Heap UAF via XMP Parsing
CVE-2026-61857
3.7 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.
Unchecked Return Value
ImageMagick <7.1.2-26 memory overalloc in matrix ops (-canny)
CVE-2026-61465
3.3 - Low
- July 11, 2026
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.
Allocation of Resources Without Limits or Throttling
ImageMagick <=7.1.2-19 Magnify OOB Read Heap Buffer Overflow
CVE-2026-56372
3.3 - Low
- July 11, 2026
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.
Heap-based Buffer Overflow
ImageMagick use-after-free in PDB decoder before 7.1.2-15
CVE-2026-56373
3.7 - Low
- July 10, 2026
ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.
Dangling pointer
ImageMagick <7.1.2-18 Memory Leak in META Reader (APP1JPEG)
CVE-2026-56366
3.3 - Low
- July 10, 2026
ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.
Memory Leak
ImageMagick <7.1.2-19 Heap Buffer Overflow in FTXT Encoder
CVE-2026-56374
3.3 - Low
- July 08, 2026
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of service or information disclosure.
Out-of-bounds Read
ImageMagick <7.1.2-15 Heap BOV Read via GetPixelIndex
CVE-2026-56362
3.3 - Low
- July 08, 2026
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting any writer calling GetPixelIndex.
Out-of-bounds Read
ImageMagick before 7.1.2-26 JP2 Encoder Heap Buffer Overwrite
CVE-2026-55597
5.5 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.
Incorrect Calculation
ImageMagick 6.9.13-51/7.1.2-26 Infinite Loop via connected-components
CVE-2026-55595
4.7 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Resource Exhaustion
ImageMagick <6.9.13-51/<7.1.2-26: MVG Decoder Stack Overflow
CVE-2026-55594
5.3 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Resource Exhaustion
ImageMagick MVG Heap Buffer Overflow before 7.1.2-26
CVE-2026-55577
5.9 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Improper Check for Unusual or Exceptional Conditions
ImageMagick UAF via crafted 8BIM format string before 6.9.13-51/7.1.2-26
CVE-2026-55510
5.5 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Dangling pointer
ImageMagick MNG Decoder Heap Info Disclosure (before 6.9.13-51/7.1.2-26)
CVE-2026-53467
5.3 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Use of Uninitialized Resource
ImageMagick XCF decoder integer overflow before 6.9.13-51 & 7.1.2-26
CVE-2026-53466
6.5 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Integer Overflow or Wraparound
Missing policy checks in -concatenate operation before 7.1.2-26 (fixed)
CVE-2026-55628
5.5 - Medium
- July 01, 2026
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.
External Control of File Name or Path
ImageMagick <=7.1.2-24 arbitrary file write via policy check flaw
CVE-2026-56377
3.3 - Low
- June 30, 2026
ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.
Directory traversal
ImageMagick <7.1.2-22: PasskeyEncipherImage AES-CTR Nonce Reuse Disclosure
CVE-2026-56369
3.7 - Low
- June 30, 2026
ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.
Reusing a Nonce, Key Pair in Encryption
ImageMagick <=7.1.2-18 PNG Encoder Memory Leak (PNG MNG)
CVE-2026-56365
3.7 - Low
- June 30, 2026
ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.
Memory Leak
ImageMagick 7.1.2-13 Memory Leak in LoadOpenCLDeviceBenchmark()
CVE-2026-56364
1.9 - Low
- June 30, 2026
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.
Memory Leak
ImageMagick <7.1.2-22 Division By Zero in Binomial Kernel (DoS)
CVE-2026-56363
3.3 - Low
- June 30, 2026
ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash.
Integer Overflow or Wraparound
ImageMagick <7.1.2-19 OOB HEAP read via morphology off-by-one
CVE-2026-56361
3.3 - Low
- June 30, 2026
ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations.
Out-of-bounds Read
ImageMagick 7.1.2-19 OOB in ConnectedComponentsImage CLI
CVE-2026-56370
3.3 - Low
- June 24, 2026
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution.
Out-of-bounds Read
ImageMagick <7.1.2-15 memory leak in raw pixel coders -> DoS
CVE-2026-56368
3.7 - Low
- June 24, 2026
ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.
Memory Leak
ImageMagick SVG decoder command injection (pre 7.1.2-15 / pre 6.9.13-40)
CVE-2026-56379
8.1 - High
- June 23, 2026
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
Output Sanitization
ImageMagick <7.1.2-15,6.9.13-40: heap use-after-free in meta coder leads to DoS
CVE-2026-56376
3.7 - Low
- June 23, 2026
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service.
Dangling pointer
ImageMagick <=7.1.2-15, 6.9.13-40: TXT coder memory leak via texture attributes
CVE-2026-56371
5.3 - Medium
- June 23, 2026
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed.
Memory Leak
ImageMagick <=7.1.2-15 Heap OOB Read in PCD Decoder
CVE-2026-56378
3.7 - Low
- June 21, 2026
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte.
Out-of-bounds Read
ImageMagick <7.1.2-15, 6.9.13-40: PSB RLE Integer Overflow (OOB Read)
CVE-2026-56367
3.7 - Low
- June 21, 2026
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash.
Out-of-bounds Read
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for ImageMagick or by ImageMagick? Click the Watch button to subscribe.
