ImageMagick vulnerabilities and threats

CVE-2026-116140 is a vulnerability in ImageMagick before versions 6.9.13-58 and 7.1.2-33 where delegate invocations are incorrectly parsed. This flaw allows an attacker to bypass administrator-defined policies in policy.xml, enabling execution of programs that should be blocked. The vulnerability has a medium severity score of 4.8 and affects both major branches of ImageMagick prior to the fixed versions.

CVE-2026-56377 is a path traversal vulnerability in ImageMagick versions before 7.1.2-24. The flaw arises from an incorrect policy check that allows attackers to bypass pathname restrictions in sandboxed conversion services. This enables remote attackers with limited privileges to create or truncate files outside the intended directories, violating security policies.

A memory leak vulnerability exists in ImageMagick versions before 7.1.2-19 in the PNG encoder when writing MNG images. This flaw allows attackers to trigger encoder failure conditions that exhaust memory resources, potentially causing a denial of service.

A memory leak vulnerability exists in ImageMagick versions before 7.1.2-13 in the LoadOpenCLDeviceBenchmark() function. This occurs when parsing malformed OpenCL device profile XML files containing unclosed device elements. An attacker with write access to the OpenCL cache directory can exploit this by placing malicious XML files, potentially exhausting memory and causing a denial of service.

ImageMagick versions before 7.1.2-22 have a vulnerability in binomial kernel processing where supplying a large binomial kernel value can cause an integer overflow leading to a division by zero and application crash. This results in a denial of service condition.

ImageMagick - Infinite Loop in the MIFF decoder can lead to CPU exhaustion

ImageMagick contains an improper input validation vulnerability affecting multiple coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT). This flaw allows remote attackers to execute arbitrary code via shell metacharacters in crafted images. The vulnerability is known to be exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the input data.

CVE-2016-3715 is a high-severity vulnerability in ImageMagick that allows arbitrary file deletion through the use of the 'ephemeral' pseudo protocol. This protocol deletes files after reading, and the vulnerability enables attackers to exploit this behavior to delete files on the system. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

ImageMagick contains a vulnerability that allows attackers to perform server-side request forgery (SSRF) by submitting a crafted image. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.