CVE-2026-105404
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in...
6.0 MediumFix availableRejected
This CVE ID has been rejected as a duplicate.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-35jq-x7wg-cpwf
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in...
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in its PostScript coders, because some values are not properly escaped or trimmed when written to output. Attackers can supply crafted values that embed arbitrary PostScript code into files generated by these coders.
- Record
GHSA-35jq-x7wg-cpwf- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
This CVE ID has been rejected as a duplicate.
- Record
CVE-2026-105404- Updated
- 2026-11-02
EUVDEUVD-2026-95008
This CVE ID has been rejected as a duplicate.
- Record
EUVD-2026-95008- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD No score
Rejected reason: This CVE ID has been rejected as a duplicate.
- Record
CVE-2026-105404- Updated
- 2026-11-02
OSV
ImageMagick before 7.1.2-31 Code Injection via PostScript Coders
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in its PostScript coders, because some values are not properly escaped or trimmed when written to output. Attackers can supply crafted values that embed arbitrary PostScript code into files generated by these coders.
- Record
CVE-2026-105404- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVCVE-2026-106577
ImageMagick: Code Injection in the postscript coders
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
- Record
CVE-2026-106577- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-105404
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in its PostScript coders, because some values are not properly escaped or trimmed when written to output. Attackers can supply crafted values that embed arbitrary PostScript code into files generated by these coders.
- Record
DEBIAN-CVE-2026-105404- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVCLSA-2026-1792591008 No score
ImageMagick: Fix of 8 CVEs
- CVE-2026-105081: deny dangling/looping symlinks in path policy checks
- CVE-2026-105403: check the coder policy against the coder actually used (also CVE-2026-106579)
- CVE-2026-105404: escape labels written into PostScript/PDF output
- CVE-2026-105823: apply the path policy to CUT palette files (also CVE-2026-106580)
- CVE-2026-106566: honour MAGICK_SHRED_PASSES when deciding on unique symlinks
- CVE-2026-55628: apply the path policy to convert -concatenate inputs and output
- Record
CLSA-2026-1792591008- Updated
- 2026-11-02
OSVCLSA-2026-1792591590 No score
ImageMagick: Fix of 7 CVEs
- CVE-2026-105081: deny dangling/looping symlinks in path policy checks
- CVE-2026-105403: check the coder policy against the coder actually used (also CVE-2026-106579)
- CVE-2026-105404: escape labels written into PostScript/PDF output
- CVE-2026-105823: apply the path policy to CUT palette files (also CVE-2026-106580)
- CVE-2026-106566: honour MAGICK_SHRED_PASSES when deciding on unique symlinks
- CVE-2026-55628: apply the path policy to convert -concatenate inputs and output
- Record
CLSA-2026-1792591590- Updated
- 2026-11-02
OSVCLSA-2026-1792591674 No score
ImageMagick: Fix of 8 CVEs
- CVE-2026-105081: deny dangling/looping symlinks in path policy checks
- CVE-2026-105403: check the coder policy against the coder actually used (also CVE-2026-106579)
- CVE-2026-105404: escape labels written into PostScript/PDF output
- CVE-2026-105823: apply the path policy to CUT palette files (also CVE-2026-106580)
- CVE-2026-106566: honour MAGICK_SHRED_PASSES when deciding on unique symlinks
- CVE-2026-55628: apply the path policy to convert -concatenate inputs and output
- Record
CLSA-2026-1792591674- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12139-1 No score
ImageMagick-7.1.2.33-1.1 on GA media
These are all security issues fixed in the ImageMagick-7.1.2.33-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12139-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ImageMagickTuxCare:RHEL:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-c++TuxCare:RHEL:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-c++-develTuxCare:RHEL:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-develTuxCare:RHEL:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-docTuxCare:RHEL:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-perlTuxCare:RHEL:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagickTuxCare:CentOS:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-c++TuxCare:CentOS:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-c++-develTuxCare:CentOS:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-develTuxCare:CentOS:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ImageMagick-docTuxCare:CentOS:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-perlTuxCare:CentOS:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagickTuxCare:OracleLinux:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-c++TuxCare:OracleLinux:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-c++-develTuxCare:OracleLinux:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-develTuxCare:OracleLinux:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-docTuxCare:OracleLinux:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
ImageMagick-perlTuxCare:OracleLinux:7 From an advisory covering 8 CVEs |
before 6.9.10.68-7.0.11.el7_9.tuxcare.els7 | 6.9.10.68-7.0.11.el7_9.tuxcare.els7 |
imagemagickDebian:12 |
All versions, plus listed versions 8:6.9.11.60+dfsg-1.68:6.9.11.60+dfsg-1.6+deb12u18:6.9.11.60+dfsg-1.6+deb12u108:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u12 Show 45 moreShow less8:6.9.11.60+dfsg-1.6+deb12u138:6.9.11.60+dfsg-1.6+deb12u28:6.9.11.60+dfsg-1.6+deb12u38:6.9.11.60+dfsg-1.6+deb12u48:6.9.11.60+dfsg-1.6+deb12u58:6.9.11.60+dfsg-1.6+deb12u68:6.9.11.60+dfsg-1.6+deb12u78:6.9.11.60+dfsg-1.6+deb12u88:6.9.11.60+dfsg-1.6+deb12u98:6.9.12.20+dfsg1-18:6.9.12.20+dfsg1-1.18:6.9.12.20+dfsg1-1.28:6.9.12.98+dfsg1-18:6.9.12.98+dfsg1-28:6.9.12.98+dfsg1-38:6.9.12.98+dfsg1-48:6.9.12.98+dfsg1-58:6.9.12.98+dfsg1-5.18:6.9.12.98+dfsg1-5.1~exp18:6.9.12.98+dfsg1-5.28:6.9.13.12+dfsg1-18:7.1.1.33+dfsg1-18:7.1.1.33+dfsg1-28:7.1.1.39+dfsg1-18:7.1.1.39+dfsg1-28:7.1.1.39+dfsg1-38:7.1.1.43+dfsg1-18:7.1.1.46+dfsg1-18:7.1.1.47+dfsg1-18:7.1.1.47+dfsg1-28:7.1.2.1+dfsg1-18:7.1.2.12+dfsg1-18:7.1.2.13+dfsg1-18:7.1.2.15+dfsg1-18:7.1.2.15+dfsg1-28:7.1.2.16+dfsg1-18:7.1.2.18+dfsg1-18:7.1.2.19+dfsg1-18:7.1.2.21+dfsg1-18:7.1.2.23+dfsg1-18:7.1.2.24+dfsg1-18:7.1.2.25+dfsg1-18:7.1.2.25+dfsg1-28:7.1.2.26+dfsg1-18:7.1.2.27+dfsg1-1 |
None known |
imagemagickDebian:13 |
All versions, plus listed versions 8:7.1.1.43+dfsg1-18:7.1.1.43+dfsg1-1+deb13u18:7.1.1.43+dfsg1-1+deb13u108:7.1.1.43+dfsg1-1+deb13u118:7.1.1.43+dfsg1-1+deb13u12 Show 31 moreShow less8:7.1.1.43+dfsg1-1+deb13u28:7.1.1.43+dfsg1-1+deb13u38:7.1.1.43+dfsg1-1+deb13u48:7.1.1.43+dfsg1-1+deb13u58:7.1.1.43+dfsg1-1+deb13u68:7.1.1.43+dfsg1-1+deb13u78:7.1.1.43+dfsg1-1+deb13u88:7.1.1.43+dfsg1-1+deb13u98:7.1.1.46+dfsg1-18:7.1.1.47+dfsg1-18:7.1.1.47+dfsg1-28:7.1.2.1+dfsg1-18:7.1.2.12+dfsg1-18:7.1.2.13+dfsg1-18:7.1.2.15+dfsg1-18:7.1.2.15+dfsg1-28:7.1.2.16+dfsg1-18:7.1.2.18+dfsg1-18:7.1.2.19+dfsg1-18:7.1.2.21+dfsg1-18:7.1.2.23+dfsg1-18:7.1.2.24+dfsg1-18:7.1.2.25+dfsg1-18:7.1.2.25+dfsg1-28:7.1.2.26+dfsg1-18:7.1.2.27+dfsg1-18:7.1.2.29+dfsg2-18:7.1.2.3+dfsg1-18:7.1.2.31+dfsg1-18:7.1.2.7+dfsg1-18:7.1.2.8+dfsg1-1 |
None known |
imagemagickDebian:14 |
before 8:7.1.2.31+dfsg1-1, plus listed versions 8:7.1.1.43+dfsg1-18:7.1.1.46+dfsg1-18:7.1.1.47+dfsg1-18:7.1.1.47+dfsg1-28:7.1.2.1+dfsg1-1 Show 18 moreShow less8:7.1.2.12+dfsg1-18:7.1.2.13+dfsg1-18:7.1.2.15+dfsg1-18:7.1.2.15+dfsg1-28:7.1.2.16+dfsg1-18:7.1.2.18+dfsg1-18:7.1.2.19+dfsg1-18:7.1.2.21+dfsg1-18:7.1.2.23+dfsg1-18:7.1.2.24+dfsg1-18:7.1.2.25+dfsg1-18:7.1.2.25+dfsg1-28:7.1.2.26+dfsg1-18:7.1.2.27+dfsg1-18:7.1.2.29+dfsg2-18:7.1.2.3+dfsg1-18:7.1.2.7+dfsg1-18:7.1.2.8+dfsg1-1 |
8:7.1.2.31+dfsg1-1 |
ImageMagickopenSUSE:Tumbleweed From an advisory covering 13 CVEs |
before 7.1.2.33-1.1 | 7.1.2.33-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-105404 has been rejected by its source and should not be treated as a live vulnerability, published October 7, 2026. Fixed in imagemagick 8:7.1.2.31+dfsg1-1.
References
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892
nvd.nist.gov/vuln/detail/CVE-2026-105404
vulncheck.com/advisories/imagemagick-before-7.1.2-31-code-injection-via-postscript-coders
errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792591008.html
Show 31 moreShow less
security-tracker.debian.org/tracker/CVE-2026-105404
suse.com/security/cve/CVE-2026-105398
This page doesn't list everything
Left out here: 5 versions. The JSON record has them.