ImageMagick vulnerabilities and threats

CVE-2026-116160 is a heap-based buffer overflow vulnerability in ImageMagick affecting versions before 6.9.13-58 and 7.x before 7.1.2-33. The flaw occurs in the X11 animate operation when processing specially crafted images, potentially causing heap memory overwrite and application crashes. The vulnerability has a medium severity score of 4.8 and requires user interaction to trigger. Fixed versions 6.9.13-58 and 7.1.2-33 are available.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.

ImageMagick versions before 7.1.2-33 have a memory leak vulnerability in the magick compare command. This occurs due to missing cleanup when an operation fails, allowing attackers to cause repeated failed compare operations that exhaust memory and lead to denial of service.

CVE-2026-116157 is a memory leak vulnerability in ImageMagick's PerlMagick component before version 7.1.2-33. The flaw causes failure to release memory after reading image properties, which can be repeatedly triggered to exhaust system memory and cause denial of service.

CVE-2026-116156 is a memory leak vulnerability in ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33. The flaw occurs due to missing cleanup when the -set profile option is used during image processing. An attacker can exploit this by inducing a user to process crafted images, potentially causing resource exhaustion and denial of service.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.

CVE-2026-116154 is a memory leak vulnerability in ImageMagick's XML parsing code affecting versions before 6.9.13-58 and 7.x before 7.1.2-33. The flaw occurs when parsing deeply nested XML data, where allocated memory is not released upon reaching the nesting depth limit. This can lead to memory exhaustion and denial of service.

ImageMagick versions prior to 7.1.2-33 on 32-bit systems contain a heap buffer overflow vulnerability triggered by processing crafted images that request convex-hull calculations. This flaw allows attackers to overwrite heap memory, potentially causing application crashes or enabling code execution.

CVE-2026-116152 is a memory leak vulnerability in ImageMagick versions before 7.1.2-33. It occurs in the MAT decoder where allocated memory is not released properly in a specific error path. An attacker can exploit this by supplying crafted MAT files that repeatedly trigger the error, causing gradual memory consumption of the process.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service.

ImageMagick versions before 7.1.2-33 have a memory leak vulnerability in the FPX encoder. This flaw allows attackers to supply crafted images that cause repeated memory leaks during FPX encoding. The resulting resource exhaustion can lead to denial of service conditions. The vulnerability has a low severity rating and a CVSS score of 2.3. A fix is available in version 7.1.2-33.

A stack-based buffer overflow vulnerability exists in ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33. The flaw occurs in the processing of bzip2 compressed images, where specially crafted input can overwrite stack memory during decoding, potentially causing crashes or memory corruption.

CVE-2026-116148 is a medium severity cross-site scripting (XSS) vulnerability in ImageMagick affecting versions before 6.9.13-58 and 7.x before 7.1.2-33. The flaw exists in the MVG encoder, which fails to properly neutralize user-supplied drawing options before embedding them into generated MVG files. This allows attackers who can supply drawing options to inject arbitrary MVG drawing commands.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process and causes a denial of service.

CVE-2026-116146 is a memory leak vulnerability in ImageMagick's MSL decoder present in versions before 6.9.13-58 and 7.x before 7.1.2-33. The flaw causes allocated memory not to be released when processing crafted MSL images, enabling attackers to cause resource exhaustion and denial of service by repeatedly supplying malicious files.

CVE-2026-116145 is a vulnerability in ImageMagick before versions 6.9.13-58 and 7.1.2-32. It involves a security policy bypass due to an incomplete fix of a previous policy bypass issue. An attacker who can supply input to ImageMagick may evade configured security policy restrictions, allowing operations that should be blocked by the policy.

CVE-2026-116144 is a vulnerability in ImageMagick before versions 6.9.13-58 and 7.1.2-33 involving uncontrolled recursion in the MVG decoder. This flaw can cause a stack overflow when processing specially crafted MVG files, leading to a denial of service by crashing the process.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than permitted, potentially exhausting resources.

ImageMagick versions before 7.1.2-33 contain a heap buffer over-read vulnerability that occurs when printing a minimum-bounding-box. An attacker can supply a specially crafted image to trigger this over-read, potentially causing application crashes or exposing adjacent heap memory.

CVE-2026-116141 is a vulnerability in ImageMagick before version 7.1.2-33 where attackers can bypass image dimension limits in the UHDR decoder. This occurs because the checks on image width and height happen after decoding, allowing crafted images with oversized dimensions to be fully decoded. The result is uncontrolled resource consumption, potentially leading to denial of service.