CVE-2023-2157
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to...
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
- Record
CVE-2023-2157- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-122, CWE-787
- Updated
- 2026-11-02
CVE List
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
- Record
CVE-2023-2157- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2023-33675
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
- Record
EUVD-2023-33675- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-336m-6jwp-8932
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to...
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
- Record
GHSA-336m-6jwp-8932- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-122, CWE-787
- Updated
- 2026-11-02
OSV
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
- Record
CVE-2023-2157- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-2157
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
- Record
DEBIAN-CVE-2023-2157- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVJLSEC-2026-903
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
- Record
JLSEC-2026-903- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1330
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.(CVE-2023-2157)
- Record
OESA-2023-1330- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1331
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.(CVE-2023-2157)
- Record
OESA-2023-1331- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1332
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.(CVE-2023-2157)
- Record
OESA-2023-1332- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1333
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.(CVE-2023-2157)
- Record
OESA-2023-1333- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12954-1 No score
ImageMagick-7.1.1.10-1.1 on GA media
These are all security issues fixed in the ImageMagick-7.1.1.10-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12954-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagemagickDebian:13 |
before 8:6.9.12.98+dfsg1-2 | 8:6.9.12.98+dfsg1-2 |
imagemagickDebian:14 |
before 8:6.9.12.98+dfsg1-2 | 8:6.9.12.98+dfsg1-2 |
ImageMagick_jllJulia |
before 7.1.1+0 | 7.1.1+0 |
ImageMagickopenEuler:20.03-LTS-SP1 |
before 6.9.12.86-1.oe1 | 6.9.12.86-1.oe1 |
ImageMagickopenEuler:20.03-LTS-SP3 |
before 6.9.12.86-1.oe1 | 6.9.12.86-1.oe1 |
ImageMagickopenEuler:22.03-LTS |
before 7.1.1.8-1.oe2203 | 7.1.1.8-1.oe2203 |
ImageMagickopenEuler:22.03-LTS-SP1 |
before 7.1.1.8-1.oe2203sp1 | 7.1.1.8-1.oe2203sp1 |
ImageMagickopenSUSE:Tumbleweed |
before 7.1.1.10-1.1 | 7.1.1.10-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2157 is a medium vulnerability (CVSS 5.5) in Imagemagick, published June 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in imagemagick 8:6.9.12.98+dfsg1-2.
References
bugzilla.redhat.com/show_bug.cgi?id=2208537
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45DUUXYMAEEAW55GSLAXN25VPKCRAIDA
nvd.nist.gov/vuln/detail/CVE-2023-2157
github.com/advisories/GHSA-336m-6jwp-8932
Show 6 moreShow less
security-tracker.debian.org/tracker/CVE-2023-2157
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1330
suse.com/security/cve/CVE-2023-2157