CVE-2023-34153
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection...
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
- Record
CVE-2023-34153- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
- Record
CVE-2023-34153- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2023-38253
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
- Record
EUVD-2023-38253- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7c5r-cghm-f2jx
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection...
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
- Record
GHSA-7c5r-cghm-f2jx- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
- Record
CVE-2023-34153- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVJLSEC-2026-907
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
- Record
JLSEC-2026-907- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVOESA-2023-1349
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546).(CVE-2023-34151)
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.(CVE-2023-34153)
- Record
OESA-2023-1349- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2023-1350
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546).(CVE-2023-34151)
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.(CVE-2023-34153)
- Record
OESA-2023-1350- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13263-1 No score
ImageMagick-7.1.1.17-1.1 on GA media
These are all security issues fixed in the ImageMagick-7.1.1.17-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13263-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2344-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2023-34151: Fixed an undefined behavior issue due to floating point truncation (bsc#1211791).
- CVE-2023-34153: Fixed a command injection issue when encoding or decoding VIDEO files (bsc#1211792).
- Record
SUSE-SU-2023:2344-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ImageMagick_jllJulia |
7.1.0+0 up to 7.1.1+0 | 7.1.1+0 |
ImageMagickopenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 7.1.1.8-2.oe2203 | 7.1.1.8-2.oe2203 |
ImageMagickopenEuler:22.03-LTS-SP1 From an advisory covering 2 CVEs |
before 7.1.1.8-2.oe2203sp1 | 7.1.1.8-2.oe2203sp1 |
ImageMagickSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 2 CVEs |
before 7.1.0.9-150400.6.21.1 | 7.1.0.9-150400.6.21.1 |
ImageMagickSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 From an advisory covering 2 CVEs |
before 7.1.0.9-150400.6.21.1 | 7.1.0.9-150400.6.21.1 |
ImageMagickSUSE:Linux Enterprise Module for Development Tools 15 SP4 From an advisory covering 2 CVEs |
before 7.1.0.9-150400.6.21.1 | 7.1.0.9-150400.6.21.1 |
ImageMagickSUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 2 CVEs |
before 7.1.0.9-150400.6.21.1 | 7.1.0.9-150400.6.21.1 |
ImageMagickopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 7.1.0.9-150400.6.21.1 | 7.1.0.9-150400.6.21.1 |
ImageMagickopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 7.1.0.9-150400.6.21.1 | 7.1.0.9-150400.6.21.1 |
ImageMagickopenSUSE:Tumbleweed From an advisory covering 15 CVEs |
before 7.1.1.17-1.1 | 7.1.1.17-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34153 is a high vulnerability (CVSS 7.8) in Imagemagick, published May 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.14%, the 87th percentile. Fixed in ImageMagick_jll 7.1.1+0.
References
github.com/ImageMagick/ImageMagick/issues/6338
bugzilla.redhat.com/show_bug.cgi?id=2210660
access.redhat.com/security/cve/CVE-2023-34153
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2ZUHZXQ2C3JZYKPW4XHCMVVL467MA2V
nvd.nist.gov/vuln/detail/CVE-2023-34153
Show 25 moreShow less
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1349
suse.com/support/update/announcement/2023/suse-su-20232344-1
bugzilla.suse.com/1211791