Skip to main content
VulnerabilityPublished Updated

CVE-2026-30936: imagemagick vulnerabilities

Affects imagemagickSource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited · fixed in 8:6.7.7.10-6ubuntu3.13+esm24 : update imagemagick when convenient.

Data as of 12 Nov 2026, 18:49 UTC

Severity
Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Patch
Available – fixed in 8:6.7.7.10-6ubuntu3.13+esm24, 8:6.8.9.9-7ubuntu5.16+esm23, 8:6.9.7.4+dfsg-16ubuntu6.15+esm15 +3

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 10 Aug 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 12 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
Ubuntu Pro 24.04 LTSimagemagickpkg:deb/ubuntu/imagemagick?arch=source&distro=esm-apps/nobleOther threatsAffected
  • <8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm12
Fixed in
  • 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm12
Ubuntu Pro 22.04 LTSimagemagickpkg:deb/ubuntu/imagemagick?arch=source&distro=esm-apps/jammyOther threatsAffected
  • <8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm13
  • =8:6.9.11.60+dfsg-1ubuntu1
Fixed in
  • 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm13
Ubuntu Pro 20.04 LTSimagemagickpkg:deb/ubuntu/imagemagick?arch=source&distro=esm-apps/focalOther threatsAffected
  • <8:6.9.10.23+dfsg-2.1ubuntu11.11+esm13
Fixed in
  • 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm13
Ubuntu Pro 18.04 LTSimagemagickpkg:deb/ubuntu/imagemagick?arch=source&distro=esm-infra/bionicOther threatsAffected
  • <8:6.9.7.4+dfsg-16ubuntu6.15+esm15
Fixed in
  • 8:6.9.7.4+dfsg-16ubuntu6.15+esm15
Ubuntu Pro 16.04 LTSimagemagickpkg:deb/ubuntu/imagemagick?arch=source&distro=esm-infra-legacy/xenialOther threatsAffected
  • <8:6.8.9.9-7ubuntu5.16+esm23
Fixed in
  • 8:6.8.9.9-7ubuntu5.16+esm23
Ubuntu Pro 14.04 LTSimagemagickpkg:deb/ubuntu/imagemagick?arch=source&distro=esm-infra-legacy/trustyOther threatsAffected
  • <8:6.7.7.10-6ubuntu3.13+esm24
Fixed in
  • 8:6.7.7.10-6ubuntu3.13+esm24

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Hao Ren discovered that ImageMagick incorrectly handled certain images when using the wavelet-denoise operation. An attacker could possibly use this issue to trigger an out-of-bounds heap write, resulting in arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-30936) It was discovered that ImageMagick incorrectly handled extremely large XWD images. An attacker could possibly use this issue to trigger an out-of-bounds heap write, resulting in arbitrary code execution. (CVE-2026-30937) It was discovered that ImageMagick incorrectly handled extremely large SFW images on 32-bit systems. An attacker could possibly use this issue to trigger an integer overflow, resulting in a denial of service. (CVE-2026-31853) It was discovered that ImageMagick incorrectly handled memory allocation failures in the sixel encoder. An attacker could possibly use this issue to trigger a stack buffer overflow, resulting in arbitrary code execution. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-32259)

References

Community reviews

Loading reviews…