ImageMagick versions before 7.1.2-33 contain a heap buffer overflow vulnerability affecting 32-bit systems. This flaw occurs when convex-hull information is requested, allowing attackers to supply crafted images that trigger heap memory corruption. The vulnerability can cause application crashes and may potentially allow code execution.
ImageMagick versions before 7.1.2-33 have a memory leak vulnerability in the MAT image decoder. This flaw occurs because allocated memory is not released in a specific error path. An attacker can exploit this by supplying crafted MAT files that repeatedly trigger the error, causing gradual memory consumption in the process.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the JNG encoder. This flaw causes allocated memory to not be released when processing crafted JNG images, potentially leading to resource exhaustion and a limited denial of service.
ImageMagick versions prior to 7.1.2-33 contain a memory leak vulnerability in the FPX encoder. This flaw allows attackers to supply crafted FPX images that cause repeated memory leaks, leading to resource exhaustion and denial of service. The vulnerability has a low severity rating and does not impact confidentiality or integrity.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a stack-based buffer overflow vulnerability in the handling of bzip2 compressed images. This flaw allows attackers to supply crafted bzip2 compressed images that can overwrite stack memory during decoding, potentially causing crashes or memory corruption. The vulnerability has a high severity rating with a CVSS score of 8.1.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have an injection vulnerability in the MVG encoder. This flaw allows attackers who can supply drawing options to inject arbitrary MVG drawing commands into generated MVG files. The vulnerability has a low severity with a CVSS score of 3.6 and requires local access with user interaction for exploitation.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a null pointer dereference vulnerability in the DJVU image decoder. This occurs because the software does not check the result of a memory allocation before use. An attacker can supply a specially crafted DJVU image that triggers a process crash under memory allocation failure conditions, resulting in denial of service.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the MSL decoder. This flaw causes allocated memory to not be released when processing crafted MSL images, potentially leading to resource exhaustion and denial of service.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-32 contain a security policy bypass vulnerability due to an incomplete fix of a previous bypass issue. This flaw allows an attacker who can supply input to ImageMagick to circumvent configured security policy restrictions, enabling operations that should have been blocked by the policy. The vulnerability has a low severity rating with a CVSS score of 3.9.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain an uncontrolled recursion vulnerability in the MVG decoder. This flaw can cause a stack overflow when processing specially crafted MVG files, leading to a denial of service by crashing the process. The vulnerability has a low severity rating and does not impact confidentiality or integrity.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a policy bypass vulnerability in the PS, PDF, and XPS decoders. This flaw allows attackers to circumvent the security policy's list length limit on scene selection by supplying a specific argument, causing ImageMagick to process more scenes than permitted. The vulnerability can potentially lead to resource exhaustion. The CVSS score is 3.3, indicating a low severity impact primarily affecting availability.
ImageMagick versions prior to 7.1.2-33 contain a heap buffer over-read vulnerability that can be triggered by supplying a crafted image during minimum-bounding-box output. This flaw allows attackers to read beyond allocated memory, potentially causing application crashes or exposure of adjacent heap memory. The vulnerability has a low severity score and requires local access with user interaction to exploit.
ImageMagick versions before 7.1.2-33 have a policy bypass vulnerability in the UHDR image decoder. This flaw allows attackers to supply crafted UHDR images with oversized dimensions that are fully decoded before image width and height limits are enforced. As a result, attackers can cause excessive resource consumption by evading these policy limits.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a vulnerability in delegate invocation parsing that allows execution of programs blocked by policy.xml. An attacker can exploit this by crafting input that triggers a delegate invocation, bypassing administrator-defined execution restrictions.
vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.
OpenResty lua-resty-dns versions before 0.24 have an input validation vulnerability in the parse_section() and _decode_name() functions. This flaw allows attackers who control or spoof a DNS server to send malformed DNS responses with truncated record headers or RDATA. Such responses cause uncaught Lua exceptions in resolver:query(), aborting DNS requests and disrupting name resolution.
A vulnerability in setuptools on Windows allows an attacker to craft a wheel file with a specially crafted .dist-info/namespace_packages.txt file. This can cause setuptools' legacy wheel installation to create an __init__.py file outside the intended installation directory, at a filesystem path influenced by the attacker. The created file contains fixed content and is created with the permissions of the installing process. The vulnerability affects setuptools versions from 2.15.3 up to but not including 2.18.1_2 and requires the target parent directory to already exist.
CVE-2026-115938 is a high-severity vulnerability in Craft CMS affecting versions 4.0.0 up to but not including 4.18.9, and 5.0.0 up to but not including 5.11.2. It involves improper neutralization of special elements in the template engine, allowing authenticated control panel users to exploit a sandbox bypass in Twig templates. This leads to leakage of the GeneralConfig::securityKey and enables offline computation of HMAC signatures, which can then be used to pass signed parameters to unsandboxed template rendering, potentially invoking native PHP callables.
CVE-2026-115935 is a high-severity code injection vulnerability in CraftCMS that allows authenticated non-admin users with control panel access to inject a new security key into the .env file via crafted API response headers. This enables the attacker to forge signed login redirects containing Twig system() callbacks, potentially leading to remote code execution. The vulnerability affects CraftCMS versions 4.0.0 up to but not including 4.18.9, and 5.0.0 up to but not including 5.11.2.