Every CVE Search/ Get API key

CVE-2026-56377

ImageMagick - Policy Bypass via Incorrect Path Validation

4.8 MediumFix available

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.16%Unchanged since Jul 1, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

ImageMagick - Policy Bypass via Incorrect Path Validation

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Record
CVE-2026-56377
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-40450 4.8

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Record
EUVD-2026-40450
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-r8hq-c3qh-xq9j 4.8

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or...

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Record
GHSA-r8hq-c3qh-xq9j
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 4.8

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Record
CVE-2026-56377
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 4.8

ImageMagick - Policy Bypass via Incorrect Path Validation

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Record
CVE-2026-56377
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVDEBIAN-CVE-2026-56377 4.8

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Record
DEBIAN-CVE-2026-56377
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 9 moreShow less
OSVJLSEC-2026-1058 4.8

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or...

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Record
JLSEC-2026-1058
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-56377 4.8

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Record
UBUNTU-CVE-2026-56377
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:11228-1 No score

ImageMagick-7.1.2.27-1.1 on GA media

These are all security issues fixed in the ImageMagick-7.1.2.27-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11228-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21391-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues

  • CVE-2026-55628: Policy Bypass in concatenate operation due to missing checks (bsc#1270081).
  • CVE-2026-56362: Heap-buffer-overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
  • CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
  • CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
  • CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
  • CVE-2026-56377: Policy Bypass can create or truncate files (bsc#1270006).
  • CVE-2026-61465: Policy Bypass possible with matrix-backed operations (bsc#1271313).
  • CVE-2026-61857: Heap-use-after-free via XMP profile could result in a crash (bsc#1271312).
  • CVE-2026-61858: Policy Bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
  • CVE-2026-61861: Use-After-Free in FormatMagickCaption when memory allocation fails (bsc#1271294).
  • CVE-2026-61870: Memory leak in VIFF encoder when allocation fails (bsc#1271293).
Record
openSUSE-SU-2026:21391-1
Updated
2026-11-02
OSVSUSE-SU-2026:22829-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues

  • CVE-2026-55628: Policy Bypass in concatenate operation due to missing checks (bsc#1270081).
  • CVE-2026-56362: Heap-buffer-overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
  • CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
  • CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
  • CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
  • CVE-2026-56377: Policy Bypass can create or truncate files (bsc#1270006).
  • CVE-2026-61465: Policy Bypass possible with matrix-backed operations (bsc#1271313).
  • CVE-2026-61857: Heap-use-after-free via XMP profile could result in a crash (bsc#1271312).
  • CVE-2026-61858: Policy Bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
  • CVE-2026-61861: Use-After-Free in FormatMagickCaption when memory allocation fails (bsc#1271294).
  • CVE-2026-61870: Memory leak in VIFF encoder when allocation fails (bsc#1271293).
Record
SUSE-SU-2026:22829-1
Updated
2026-11-02
OSVSUSE-SU-2026:3192-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues

  • CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
  • CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
  • CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
  • CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
  • CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
  • CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
  • CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
  • CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
  • CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
  • CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
  • CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
  • CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
  • CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).
Record
SUSE-SU-2026:3192-1
Updated
2026-11-02
OSVSUSE-SU-2026:3193-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues

  • CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
  • CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
  • CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
  • CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
  • CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
  • CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
  • CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
  • CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
  • CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
  • CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
  • CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
  • CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
  • CVE-2026-61861: use-after-free in FormatMagickCaption when memory allocation fails (bsc#1271294).
  • CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
  • CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
  • CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
  • CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
  • CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
  • CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
  • CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
  • CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
  • CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
  • CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).
Record
SUSE-SU-2026:3193-1
Updated
2026-11-02
OSVSUSE-SU-2026:3194-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues

  • CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
  • CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
  • CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
  • CVE-2026-61860: use-after-free when freetype initialization fails (bsc#1271494).
  • CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
  • CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
  • CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
  • CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
  • CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
  • CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
  • CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
  • CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
  • CVE-2026-61871: memory leak in ICON decoder when allocation fails (bsc#1271485).
  • CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).
  • CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
  • CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
  • CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
  • CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
  • CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
  • CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
  • CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
  • CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
  • CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
  • CVE-2026-61861: use-after-free in FormatMagickCaption when memory allocation fails (bsc#1271294).
  • CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
Record
SUSE-SU-2026:3194-1
Updated
2026-11-02
OSVSUSE-SU-2026:3219-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
  • CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
  • CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
  • CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
  • CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
  • CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
  • CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
  • CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
  • CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
  • CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
  • CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
  • CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
  • CVE-2026-61860: use-after-free when freetype initialization fails (bsc#1271494).
  • CVE-2026-61861: use-after-free in FormatMagickCaption when memory allocation fails (bsc#1271294).
  • CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
  • CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
  • CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
  • CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
  • CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
  • CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
  • CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
  • CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
  • CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
  • CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).
  • Extend CVE-2026-56379 patch by f63c78b (bsc#1268878).
Record
SUSE-SU-2026:3219-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
imagemagick
Debian:12
 before 8:6.9.11.60+dfsg-1.6+deb12u12, plus listed versions
8:6.9.11.60+dfsg-1.68:6.9.11.60+dfsg-1.6+deb12u18:6.9.11.60+dfsg-1.6+deb12u108:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u2
Show 7 moreShow less
8:6.9.11.60+dfsg-1.6+deb12u38:6.9.11.60+dfsg-1.6+deb12u48:6.9.11.60+dfsg-1.6+deb12u58:6.9.11.60+dfsg-1.6+deb12u68:6.9.11.60+dfsg-1.6+deb12u78:6.9.11.60+dfsg-1.6+deb12u88:6.9.11.60+dfsg-1.6+deb12u9
8:6.9.11.60+dfsg-1.6+deb12u12
imagemagick
Debian:13
 before 8:7.1.1.43+dfsg1-1+deb13u11, plus listed versions
8:7.1.1.43+dfsg1-18:7.1.1.43+dfsg1-1+deb13u18:7.1.1.43+dfsg1-1+deb13u108:7.1.1.43+dfsg1-1+deb13u28:7.1.1.43+dfsg1-1+deb13u3
Show 6 moreShow less
8:7.1.1.43+dfsg1-1+deb13u48:7.1.1.43+dfsg1-1+deb13u58:7.1.1.43+dfsg1-1+deb13u68:7.1.1.43+dfsg1-1+deb13u78:7.1.1.43+dfsg1-1+deb13u88:7.1.1.43+dfsg1-1+deb13u9
8:7.1.1.43+dfsg1-1+deb13u11
imagemagick
Debian:14
 before 8:7.1.2.24+dfsg1-1, plus listed versions
8:7.1.1.43+dfsg1-18:7.1.1.46+dfsg1-18:7.1.1.47+dfsg1-18:7.1.1.47+dfsg1-28:7.1.2.1+dfsg1-1
Show 12 moreShow less
8:7.1.2.12+dfsg1-18:7.1.2.13+dfsg1-18:7.1.2.15+dfsg1-18:7.1.2.15+dfsg1-28:7.1.2.16+dfsg1-18:7.1.2.18+dfsg1-18:7.1.2.19+dfsg1-18:7.1.2.21+dfsg1-18:7.1.2.23+dfsg1-18:7.1.2.3+dfsg1-18:7.1.2.7+dfsg1-18:7.1.2.8+dfsg1-1
8:7.1.2.24+dfsg1-1
ImageMagick_jll
Julia
 before 7.1.2028+0
7.1.2028+0
ImageMagick
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 7.1.2.0-160000.12.1
7.1.2.0-160000.12.1
ImageMagick
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 7.1.2.0-160000.12.1
7.1.2.0-160000.12.1
ImageMagick
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 13 CVEs
 before 6.8.8.1-71.264.1
6.8.8.1-71.264.1
ImageMagick
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 23 CVEs
 before 7.1.0.9-150400.6.101.1
7.1.0.9-150400.6.101.1
ImageMagick
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 25 CVEs
 before 7.1.1.43-150700.3.70.1
7.1.1.43-150700.3.70.1
ImageMagick
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 25 CVEs
 before 7.1.1.43-150700.3.70.1
7.1.1.43-150700.3.70.1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
ImageMagick
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 25 CVEs
 before 7.1.1.21-150600.3.80.2
7.1.1.21-150600.3.80.2
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 25 CVEs
 before 7.1.1.21-150600.3.80.2
7.1.1.21-150600.3.80.2
imagemagick
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu3
Show 39 moreShow less
8:6.7.7.10-6ubuntu3.18:6.7.7.10-6ubuntu3.28:6.7.7.10-6ubuntu3.38:6.7.7.10-6ubuntu3.48:6.7.7.10-6ubuntu3.58:6.7.7.10-6ubuntu3.68:6.7.7.10-6ubuntu3.78:6.7.7.10-6ubuntu3.88:6.7.7.10-6ubuntu3.98:6.7.7.10-6ubuntu3.118:6.7.7.10-6ubuntu3.128:6.7.7.10-6ubuntu3.138:6.7.7.10-6ubuntu3.13+esm18:6.7.7.10-6ubuntu3.13+esm28:6.7.7.10-6ubuntu3.13+esm38:6.7.7.10-6ubuntu3.13+esm48:6.7.7.10-6ubuntu3.13+esm58:6.7.7.10-6ubuntu3.13+esm68:6.7.7.10-6ubuntu3.13+esm78:6.7.7.10-6ubuntu3.13+esm88:6.7.7.10-6ubuntu3.13+esm98:6.7.7.10-6ubuntu3.13+esm108:6.7.7.10-6ubuntu3.13+esm118:6.7.7.10-6ubuntu3.13+esm128:6.7.7.10-6ubuntu3.13+esm138:6.7.7.10-6ubuntu3.13+esm148:6.7.7.10-6ubuntu3.13+esm158:6.7.7.10-6ubuntu3.13+esm168:6.7.7.10-6ubuntu3.13+esm178:6.7.7.10-6ubuntu3.13+esm188:6.7.7.10-6ubuntu3.13+esm198:6.7.7.10-6ubuntu3.13+esm208:6.7.7.10-6ubuntu3.13+esm218:6.7.7.10-6ubuntu3.13+esm228:6.7.7.10-6ubuntu3.13+esm238:6.7.7.10-6ubuntu3.13+esm248:6.7.7.10-6ubuntu3.13+esm258:6.7.7.10-6ubuntu3.13+esm268:6.7.7.10-6ubuntu3.13+esm27
 None known
imagemagick
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1
Show 45 moreShow less
8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm18:6.8.9.9-7ubuntu5.16+esm28:6.8.9.9-7ubuntu5.16+esm38:6.8.9.9-7ubuntu5.16+esm48:6.8.9.9-7ubuntu5.16+esm58:6.8.9.9-7ubuntu5.16+esm68:6.8.9.9-7ubuntu5.16+esm78:6.8.9.9-7ubuntu5.16+esm88:6.8.9.9-7ubuntu5.16+esm98:6.8.9.9-7ubuntu5.16+esm108:6.8.9.9-7ubuntu5.16+esm118:6.8.9.9-7ubuntu5.16+esm128:6.8.9.9-7ubuntu5.16+esm138:6.8.9.9-7ubuntu5.16+esm148:6.8.9.9-7ubuntu5.16+esm158:6.8.9.9-7ubuntu5.16+esm168:6.8.9.9-7ubuntu5.16+esm178:6.8.9.9-7ubuntu5.16+esm188:6.8.9.9-7ubuntu5.16+esm198:6.8.9.9-7ubuntu5.16+esm208:6.8.9.9-7ubuntu5.16+esm218:6.8.9.9-7ubuntu5.16+esm228:6.8.9.9-7ubuntu5.16+esm238:6.8.9.9-7ubuntu5.16+esm248:6.8.9.9-7ubuntu5.16+esm258:6.8.9.9-7ubuntu5.16+esm26
 None known
imagemagick
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8:6.9.7.4+dfsg-16ubuntu28:6.9.7.4+dfsg-16ubuntu38:6.9.7.4+dfsg-16ubuntu48:6.9.7.4+dfsg-16ubuntu58:6.9.7.4+dfsg-16ubuntu6
Show 29 moreShow less
8:6.9.7.4+dfsg-16ubuntu6.28:6.9.7.4+dfsg-16ubuntu6.38:6.9.7.4+dfsg-16ubuntu6.48:6.9.7.4+dfsg-16ubuntu6.78:6.9.7.4+dfsg-16ubuntu6.88:6.9.7.4+dfsg-16ubuntu6.98:6.9.7.4+dfsg-16ubuntu6.118:6.9.7.4+dfsg-16ubuntu6.128:6.9.7.4+dfsg-16ubuntu6.138:6.9.7.4+dfsg-16ubuntu6.148:6.9.7.4+dfsg-16ubuntu6.158:6.9.7.4+dfsg-16ubuntu6.15+esm18:6.9.7.4+dfsg-16ubuntu6.15+esm28:6.9.7.4+dfsg-16ubuntu6.15+esm38:6.9.7.4+dfsg-16ubuntu6.15+esm48:6.9.7.4+dfsg-16ubuntu6.15+esm58:6.9.7.4+dfsg-16ubuntu6.15+esm68:6.9.7.4+dfsg-16ubuntu6.15+esm78:6.9.7.4+dfsg-16ubuntu6.15+esm88:6.9.7.4+dfsg-16ubuntu6.15+esm98:6.9.7.4+dfsg-16ubuntu6.15+esm108:6.9.7.4+dfsg-16ubuntu6.15+esm118:6.9.7.4+dfsg-16ubuntu6.15+esm128:6.9.7.4+dfsg-16ubuntu6.15+esm138:6.9.7.4+dfsg-16ubuntu6.15+esm148:6.9.7.4+dfsg-16ubuntu6.15+esm158:6.9.7.4+dfsg-16ubuntu6.15+esm168:6.9.7.4+dfsg-16ubuntu6.15+esm178:6.9.7.4+dfsg-16ubuntu6.15+esm18
 None known
imagemagick
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
8:6.9.10.23+dfsg-2.1ubuntu38:6.9.10.23+dfsg-2.1ubuntu88:6.9.10.23+dfsg-2.1ubuntu98:6.9.10.23+dfsg-2.1ubuntu108:6.9.10.23+dfsg-2.1ubuntu11
Show 31 moreShow less
8:6.9.10.23+dfsg-2.1ubuntu11.18:6.9.10.23+dfsg-2.1ubuntu11.28:6.9.10.23+dfsg-2.1ubuntu11.48:6.9.10.23+dfsg-2.1ubuntu11.4+esm18:6.9.10.23+dfsg-2.1ubuntu11.58:6.9.10.23+dfsg-2.1ubuntu11.68:6.9.10.23+dfsg-2.1ubuntu11.6+esm18:6.9.10.23+dfsg-2.1ubuntu11.78:6.9.10.23+dfsg-2.1ubuntu11.7+esm18:6.9.10.23+dfsg-2.1ubuntu11.98:6.9.10.23+dfsg-2.1ubuntu11.9+esm18:6.9.10.23+dfsg-2.1ubuntu11.9+esm28:6.9.10.23+dfsg-2.1ubuntu11.108:6.9.10.23+dfsg-2.1ubuntu11.10+esm18:6.9.10.23+dfsg-2.1ubuntu11.118:6.9.10.23+dfsg-2.1ubuntu11.11+esm18:6.9.10.23+dfsg-2.1ubuntu11.11+esm28:6.9.10.23+dfsg-2.1ubuntu11.11+esm38:6.9.10.23+dfsg-2.1ubuntu11.11+esm48:6.9.10.23+dfsg-2.1ubuntu11.11+esm58:6.9.10.23+dfsg-2.1ubuntu11.11+esm68:6.9.10.23+dfsg-2.1ubuntu11.11+esm78:6.9.10.23+dfsg-2.1ubuntu11.11+esm88:6.9.10.23+dfsg-2.1ubuntu11.11+esm98:6.9.10.23+dfsg-2.1ubuntu11.11+esm108:6.9.10.23+dfsg-2.1ubuntu11.11+esm118:6.9.10.23+dfsg-2.1ubuntu11.11+esm128:6.9.10.23+dfsg-2.1ubuntu11.11+esm138:6.9.10.23+dfsg-2.1ubuntu11.11+esm148:6.9.10.23+dfsg-2.1ubuntu11.11+esm158:6.9.10.23+dfsg-2.1ubuntu11.11+esm16
 None known
imagemagick
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
8:6.9.11.60+dfsg-1ubuntu18:6.9.11.60+dfsg-1.38:6.9.11.60+dfsg-1.3build18:6.9.11.60+dfsg-1.3build28:6.9.11.60+dfsg-1.3ubuntu0.22.04.1
Show 24 moreShow less
8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.28:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.38:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm48:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm68:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm78:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm88:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm98:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm108:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm118:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm128:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm138:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm148:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm158:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16
 None known
imagemagick
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
8:6.9.11.60+dfsg-1.6ubuntu18:6.9.12.98+dfsg1-58:6.9.12.98+dfsg1-5.2build18:6.9.12.98+dfsg1-5.2build28:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1
Show 14 moreShow less
8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm28:6.9.12.98+dfsg1-5.2ubuntu0.1~esm38:6.9.12.98+dfsg1-5.2ubuntu0.1~esm48:6.9.12.98+dfsg1-5.2ubuntu0.1~esm58:6.9.12.98+dfsg1-5.2ubuntu0.1~esm68:6.9.12.98+dfsg1-5.2ubuntu0.1~esm78:6.9.12.98+dfsg1-5.2ubuntu0.1~esm88:6.9.12.98+dfsg1-5.2ubuntu0.1~esm98:6.9.12.98+dfsg1-5.2ubuntu0.1~esm108:6.9.12.98+dfsg1-5.2ubuntu0.1~esm118:6.9.12.98+dfsg1-5.2ubuntu0.1~esm128:6.9.12.98+dfsg1-5.2ubuntu0.1~esm138:6.9.12.98+dfsg1-5.2ubuntu0.1~esm148:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15
 None known
imagemagick
Ubuntu:25.10
 All versions, plus listed versions
8:7.1.1.43+dfsg1-18:7.1.1.43+dfsg1-1ubuntu18:7.1.1.43+dfsg1-1ubuntu28:7.1.2.3+dfsg1-18:7.1.2.3+dfsg1-1ubuntu0.1
 None known
imagemagick
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
8:7.1.2.3+dfsg1-18:7.1.2.8+dfsg1-18:7.1.2.12+dfsg1-18:7.1.2.13+dfsg1-18:7.1.2.15+dfsg1-1
Show 6 moreShow less
8:7.1.2.16+dfsg1-18:7.1.2.18+dfsg1-18:7.1.2.18+dfsg1-1ubuntu0.1~esm18:7.1.2.18+dfsg1-1ubuntu0.1~esm28:7.1.2.18+dfsg1-1ubuntu0.1~esm38:7.1.2.18+dfsg1-1ubuntu0.1~esm4
 None known
ImageMagick
openSUSE:Tumbleweed
From an advisory covering 15 CVEs
 before 7.1.2.27-1.1
7.1.2.27-1.1
ImageMagick
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 7.1.2.0-160000.12.1
7.1.2.0-160000.12.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, references
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56377 is a medium vulnerability (CVSS 4.8) in Imagemagick, published June 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in imagemagick 8:6.9.11.60+dfsg-1.6+deb12u12.

References

Show 72 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open