Every CVE Search/ Get API key

CVE-2026-27799

ImageMagick has a heap Buffer Over-read in its DJVU image format handler

4.0 MediumFix available

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.14%Up 0.1 points since Feb 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.0

ImageMagick has a heap Buffer Over-read in its DJVU image format handler

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Record
CVE-2026-27799
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-122, CWE-126
Updated
2026-11-02
EUVDEUVD-2026-8772 4.0

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Record
EUVD-2026-8772
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-r99p-5442-q2x2 4.0

ImageMagick has a heap Buffer Over-read in its DJVU image format handler

A heap Buffer Over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads.

Record
GHSA-r99p-5442-q2x2
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-122, CWE-126
Updated
2026-11-02
NVD 4.0

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Record
CVE-2026-27799
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-122, CWE-126
Updated
2026-11-02
OSVALPINE-CVE-2026-27799 4.4

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Record
ALPINE-CVE-2026-27799
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-03
OSV 4.0

ImageMagick has a heap Buffer Over-read in its DJVU image format handler

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Record
CVE-2026-27799
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-122, CWE-126
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2026-27799 4.4

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Record
DEBIAN-CVE-2026-27799
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVGHSA-r99p-5442-q2x2 4.0

ImageMagick has a heap Buffer Over-read in its DJVU image format handler

A heap Buffer Over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads.

Record
GHSA-r99p-5442-q2x2
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-122, CWE-126
Updated
2026-11-02
OSVJLSEC-2026-971 4.4

ImageMagick has a heap Buffer Over-read in its DJVU image format handler

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Record
JLSEC-2026-971
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-1502 4.0

ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is an open-source software suite for image processing. A heap buffer over-read vulnerability exists in its WaveletDenoise module when processing certain small-sized images. An attacker could exploit this vulnerability by crafting a malicious image file, potentially causing the application to crash (denial of service) or, under specific conditions, leaking sensitive information from the process memory.(CVE-2026-27798)

ImageMagick is a widely used open-source software suite for image processing. A vulnerability exists in its DjVu decoder where an out-of-bounds read can occur when processing a specially crafted DjVu image file. An attacker could exploit this by tricking a user into processing a malicious DjVu file, potentially leading to information disclosure, application crash, or denial of service. This vulnerability has been disclosed in a GitHub Security Advisory.(CVE-2026-27799)

Record
OESA-2026-1502
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-27799 4.0

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Record
UBUNTU-CVE-2026-27799
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2026:20337-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2026-22770: improper pointer initialization can cause denial of service (bsc#1256969).
  • CVE-2026-23874: manipulation of digital images can lead to stack overflow (bsc#1256976).
  • CVE-2026-23876: ImageMagick: maliciously crafted image can lead to heap buffer overflow (bsc#1256962).
  • CVE-2026-23952: processing comment tag can cause null pointer dereference (bsc#1257076).
  • CVE-2026-24481: Possible Heap Information Disclosure in PSD ZIP Decompression (bsc#1258743).
  • CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
  • CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
  • CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
  • CVE-2026-25637: Denial of Service via crafted image due to memory leak (bsc#1258759).
  • CVE-2026-25638: Denial of Service due to memory leak in image processing (bsc#1258793).
  • CVE-2026-25794: Heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions (bsc#1258749).
  • CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
  • CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
  • CVE-2026-25797: Code injection in various encoders (bsc#1258770).
  • CVE-2026-25798: NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (bsc#1258787).
  • CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
  • CVE-2026-25897: Out-of-bounds heap write via integer overflow in sun decoder (bsc#1258799).
  • CVE-2026-25898: Information disclosure or denial of service via crafted image with invalid pixel index (bsc#1258807).
  • CVE-2026-25965: Policy bypass through path traversal allows reading restricted content despite secured policy (bsc#1258785).
  • CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access (bsc#1258780).
  • CVE-2026-25967: Stack buffer overflow in FTXT reader via oversized integer field (bsc#1258779).
  • CVE-2026-25968: MSL attribute stack buffer overflow leads to out of bounds write (bsc#1258776).
  • CVE-2026-25969: Memory Leak in coders/ashlar.c (bsc#1258775).
  • CVE-2026-25970: Memory corruption and denial of service via signed integer overflow in SIXEL decoder (bsc#1258802).
  • CVE-2026-25971: MSL: Stack overflow in ProcessMSLScript (bsc#1258774).
  • CVE-2026-25982: Heap Out-of-Bounds Read in DCM Decoder (bsc#1258772).
  • CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
  • CVE-2026-25985: Memory allocation with excessive without limits in the internal SVG decoder (bsc#1258812).
  • CVE-2026-25986: Denial of Service via malicious YUV image processing (bsc#1258818).
  • CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
  • CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
  • CVE-2026-25989: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder (bsc#1258771).
  • CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
  • CVE-2026-26283: Possible infinite loop in JPEG encoder when using jpeg: extent (bsc#1258767).
  • CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
  • CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
  • CVE-2026-27798: Heap Buffer Over-read in WaveletDenoise when processing small images (bsc#1259018).
  • CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).
Record
openSUSE-SU-2026:20337-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-27799 No score

CVE-2026-27799 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-27799 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-27799
Updated
2026-11-02
OSVSUSE-SU-2026:0851-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2026-24481: Possible Heap Information Disclosure in PSD ZIP Decompression (bsc#1258743).
  • CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
  • CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
  • CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
  • CVE-2026-25637: Denial of Service via crafted image due to memory leak (bsc#1258759).
  • CVE-2026-25638: Denial of Service due to memory leak in image processing (bsc#1258793).
  • CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
  • CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
  • CVE-2026-25797: Code injection in various encoders (bsc#1258770).
  • CVE-2026-25798: NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (bsc#1258787).
  • CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
  • CVE-2026-25897: Out-of-bounds heap write via integer overflow in sun decoder (bsc#1258799).
  • CVE-2026-25898: Information disclosure or denial of service via crafted image with invalid pixel index (bsc#1258807).
  • CVE-2026-25965: Policy bypass through path traversal allows reading restricted content despite secured policy (bsc#1258785).
  • CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access (bsc#1258780).
  • CVE-2026-25967: Stack buffer overflow in FTXT reader via oversized integer field (bsc#1258779).
  • CVE-2026-25968: MSL attribute stack buffer overflow leads to out of bounds write (bsc#1258776).
  • CVE-2026-25969: Memory Leak in coders/ashlar.c (bsc#1258775).
  • CVE-2026-25970: Memory corruption and denial of service via signed integer overflow in SIXEL decoder (bsc#1258802).
  • CVE-2026-25971: MSL: Stack overflow in ProcessMSLScript (bsc#1258774).
  • CVE-2026-25982: Heap Out-of-Bounds Read in DCM Decoder (bsc#1258772).
  • CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
  • CVE-2026-25985: Memory allocation with excessive without limits in the internal SVG decoder (bsc#1258812).
  • CVE-2026-25986: Denial of Service via malicious YUV image processing (bsc#1258818).
  • CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
  • CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
  • CVE-2026-25989: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder (bsc#1258771).
  • CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
  • CVE-2026-26283: Possible infinite loop in JPEG encoder when using jpeg: extent (bsc#1258767).
  • CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
  • CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
  • CVE-2026-27798: Heap Buffer Over-read in WaveletDenoise when processing small images (bsc#1259018).
  • CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).
Record
SUSE-SU-2026:0851-1
Updated
2026-11-02
OSVSUSE-SU-2026:0852-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2026-24481: Possible Heap Information Disclosure in PSD ZIP Decompression (bsc#1258743).
  • CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
  • CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
  • CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
  • CVE-2026-25637: Denial of Service via crafted image due to memory leak (bsc#1258759).
  • CVE-2026-25638: Denial of Service due to memory leak in image processing (bsc#1258793).
  • CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
  • CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
  • CVE-2026-25797: Code injection in various encoders (bsc#1258770).
  • CVE-2026-25798: NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (bsc#1258787).
  • CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
  • CVE-2026-25897: Out-of-bounds heap write via integer overflow in sun decoder (bsc#1258799).
  • CVE-2026-25898: Information disclosure or denial of service via crafted image with invalid pixel index (bsc#1258807).
  • CVE-2026-25965: Policy bypass through path traversal allows reading restricted content despite secured policy (bsc#1258785).
  • CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access (bsc#1258780).
  • CVE-2026-25967: Stack buffer overflow in FTXT reader via oversized integer field (bsc#1258779).
  • CVE-2026-25968: MSL attribute stack buffer overflow leads to out of bounds write (bsc#1258776).
  • CVE-2026-25969: Memory Leak in coders/ashlar.c (bsc#1258775).
  • CVE-2026-25970: Memory corruption and denial of service via signed integer overflow in SIXEL decoder (bsc#1258802).
  • CVE-2026-25971: MSL: Stack overflow in ProcessMSLScript (bsc#1258774).
  • CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
  • CVE-2026-25985: Memory allocation with excessive without limits in the internal SVG decoder (bsc#1258812).
  • CVE-2026-25986: Denial of Service via malicious YUV image processing (bsc#1258818).
  • CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
  • CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
  • CVE-2026-25989: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder (bsc#1258771).
  • CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
  • CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
  • CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
  • CVE-2026-27798: Heap Buffer Over-read in WaveletDenoise when processing small images (bsc#1259018).
  • CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).
Record
SUSE-SU-2026:0852-1
Updated
2026-11-02
OSVSUSE-SU-2026:0853-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2026-24481: Possible Heap Information Disclosure in PSD ZIP Decompression (bsc#1258743).
  • CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
  • CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
  • CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
  • CVE-2026-25637: Denial of Service via crafted image due to memory leak (bsc#1258759).
  • CVE-2026-25638: Denial of Service due to memory leak in image processing (bsc#1258793).
  • CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
  • CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
  • CVE-2026-25797: Code injection in various encoders (bsc#1258770).
  • CVE-2026-25798: NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (bsc#1258787).
  • CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
  • CVE-2026-25897: Out-of-bounds heap write via integer overflow in sun decoder (bsc#1258799).
  • CVE-2026-25898: Information disclosure or denial of service via crafted image with invalid pixel index (bsc#1258807).
  • CVE-2026-25965: Policy bypass through path traversal allows reading restricted content despite secured policy (bsc#1258785).
  • CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access (bsc#1258780).
  • CVE-2026-25970: Memory corruption and denial of service via signed integer overflow in SIXEL decoder (bsc#1258802).
  • CVE-2026-25971: MSL: Stack overflow in ProcessMSLScript (bsc#1258774).
  • CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
  • CVE-2026-25986: Denial of Service via malicious YUV image processing (bsc#1258818).
  • CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
  • CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
  • CVE-2026-25989: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder (bsc#1258771).
  • CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
  • CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
  • CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
  • CVE-2026-27798: Heap Buffer Over-read in WaveletDenoise when processing small images (bsc#1259018).
  • CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).
Record
SUSE-SU-2026:0853-1
Updated
2026-11-02
OSVSUSE-SU-2026:0854-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
  • CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
  • CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
  • CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
  • CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
  • CVE-2026-25797: Code injection in various encoders (bsc#1258770).
  • CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
  • CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access (bsc#1258780).
  • CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
  • CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
  • CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
  • CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
  • CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
  • CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
  • CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).
Record
SUSE-SU-2026:0854-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
Magick.NET-Q16-AnyCPU
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-HDRI-AnyCPU
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-HDRI-arm64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-HDRI-x64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-HDRI-x86
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-OpenMP-arm64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-OpenMP-x64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-OpenMP-x86
NuGet
 before 14.10.3
14.10.3
Show 67 moreShow less
Affected packages
PackageAffectedFixed
Magick.NET-Q16-arm64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-x64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q16-x86
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q8-AnyCPU
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q8-OpenMP-arm64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q8-OpenMP-x64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q8-arm64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q8-x64
NuGet
 before 14.10.3
14.10.3
Magick.NET-Q8-x86
NuGet
 before 14.10.3
14.10.3
imagemagick
Alpine:v3.22
 7.0.0-0 up to 7.1.2.15-r0
7.1.2.15-r0
imagemagick
Alpine:v3.23
 7.0.0-0 up to 7.1.2.15-r0
7.1.2.15-r0
imagemagick
Alpine:v3.24
 7.0.0-0 up to 7.1.2.15-r0
7.1.2.15-r0
imagemagick
Debian:12
 before 8:6.9.11.60+dfsg-1.6+deb12u7, plus listed versions
8:6.9.11.60+dfsg-1.68:6.9.11.60+dfsg-1.6+deb12u18:6.9.11.60+dfsg-1.6+deb12u28:6.9.11.60+dfsg-1.6+deb12u38:6.9.11.60+dfsg-1.6+deb12u48:6.9.11.60+dfsg-1.6+deb12u58:6.9.11.60+dfsg-1.6+deb12u6
8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick
Debian:13
 before 8:7.1.1.43+dfsg1-1+deb13u6, plus listed versions
8:7.1.1.43+dfsg1-18:7.1.1.43+dfsg1-1+deb13u18:7.1.1.43+dfsg1-1+deb13u28:7.1.1.43+dfsg1-1+deb13u38:7.1.1.43+dfsg1-1+deb13u48:7.1.1.43+dfsg1-1+deb13u5
8:7.1.1.43+dfsg1-1+deb13u6
imagemagick
Debian:14
 before 8:7.1.2.15+dfsg1-1, plus listed versions
8:7.1.1.43+dfsg1-18:7.1.1.46+dfsg1-18:7.1.1.47+dfsg1-18:7.1.1.47+dfsg1-28:7.1.2.1+dfsg1-1
Show 5 moreShow less
8:7.1.2.12+dfsg1-18:7.1.2.13+dfsg1-18:7.1.2.3+dfsg1-18:7.1.2.7+dfsg1-18:7.1.2.8+dfsg1-1
8:7.1.2.15+dfsg1-1
imagemagick
Debian:11
From an advisory covering 25 CVEs
 before 8:6.9.11.60+dfsg-1.3+deb11u10, plus listed versions
8:6.9.11.60+dfsg-1.38:6.9.11.60+dfsg-1.3+deb11u18:6.9.11.60+dfsg-1.3+deb11u28:6.9.11.60+dfsg-1.3+deb11u38:6.9.11.60+dfsg-1.3+deb11u4
Show 5 moreShow less
8:6.9.11.60+dfsg-1.3+deb11u58:6.9.11.60+dfsg-1.3+deb11u68:6.9.11.60+dfsg-1.3+deb11u78:6.9.11.60+dfsg-1.3+deb11u88:6.9.11.60+dfsg-1.3+deb11u9
8:6.9.11.60+dfsg-1.3+deb11u10
imagemagick
Debian:13
From an advisory covering 34 CVEs
 before 8:7.1.1.43+dfsg1-1+deb13u6, plus listed versions
8:7.1.1.43+dfsg1-18:7.1.1.43+dfsg1-1+deb13u18:7.1.1.43+dfsg1-1+deb13u28:7.1.1.43+dfsg1-1+deb13u38:7.1.1.43+dfsg1-1+deb13u48:7.1.1.43+dfsg1-1+deb13u5
8:7.1.1.43+dfsg1-1+deb13u6
imagemagick
Debian:12
From an advisory covering 25 CVEs
 before 8:6.9.11.60+dfsg-1.6+deb12u7, plus listed versions
8:6.9.11.60+dfsg-1.68:6.9.11.60+dfsg-1.6+deb12u18:6.9.11.60+dfsg-1.6+deb12u28:6.9.11.60+dfsg-1.6+deb12u38:6.9.11.60+dfsg-1.6+deb12u48:6.9.11.60+dfsg-1.6+deb12u58:6.9.11.60+dfsg-1.6+deb12u6
8:6.9.11.60+dfsg-1.6+deb12u7
Magick.NET-Q16-AnyCPU
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.16.8.8.10016.8.9.1
14.10.3
Magick.NET-Q16-HDRI-AnyCPU
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.16.8.9.1016.8.9.401
14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.18.6.08.6.1
14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.17.14.07.14.0.1
14.10.3
Magick.NET-Q16-HDRI-arm64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.18.6.08.6.1
14.10.3
Magick.NET-Q16-HDRI-x64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.16.8.9.1016.8.9.401
14.10.3
Magick.NET-Q16-HDRI-x86
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.16.8.9.1016.8.9.401
14.10.3
Magick.NET-Q16-OpenMP-arm64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.18.6.08.6.1
14.10.3
Magick.NET-Q16-OpenMP-x64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.17.14.07.14.0.1
14.10.3
Magick.NET-Q16-arm64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.18.6.08.6.1
14.10.3
Magick.NET-Q16-x64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.16.8.5.10016.8.5.401
14.10.3
Magick.NET-Q16-x86
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.16.8.5.10016.8.5.401
14.10.3
Magick.NET-Q8-AnyCPU
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.16.8.8.10016.8.9.1
14.10.3
Magick.NET-Q8-OpenMP-arm64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.18.6.08.6.1
14.10.3
Magick.NET-Q8-OpenMP-x64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.17.14.07.14.0.1
14.10.3
Magick.NET-Q8-arm64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.18.6.08.6.1
14.10.3
Magick.NET-Q8-x64
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.16.8.5.10016.8.5.401
14.10.3
Magick.NET-Q8-x86
NuGet
 before 14.10.3, plus listed versions
10.0.010.1.011.0.011.1.011.1.1
Show 45 moreShow less
11.1.211.2.011.2.111.3.012.0.012.0.112.1.012.2.012.2.112.2.212.3.013.0.013.0.113.1.013.1.113.1.213.1.313.10.013.2.013.3.013.4.013.5.013.6.013.7.013.8.013.9.013.9.114.0.014.1.014.10.014.10.114.10.214.2.014.3.014.4.014.5.014.6.014.7.014.8.014.8.114.8.214.9.014.9.16.8.5.10016.8.5.401
14.10.3
ImageMagick_jll
Julia
 before 7.1.2023+0
7.1.2023+0
ImageMagick
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 7.1.2.15-1.oe2203sp4
7.1.2.15-1.oe2203sp4
ImageMagick
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 7.1.2.15-1.oe2403sp3
7.1.2.15-1.oe2403sp3
ImageMagick
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 7.1.2.15-1.oe2403sp1
7.1.2.15-1.oe2403sp1
ImageMagick
openEuler:24.03-LTS-SP2
From an advisory covering 2 CVEs
 before 7.1.2.15-1.oe2403sp2
7.1.2.15-1.oe2403sp2
ImageMagick
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 7.1.2.15-1.oe2403sp3
7.1.2.15-1.oe2403sp3
ImageMagick
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 6.9.13.40-1.oe2003sp4
6.9.13.40-1.oe2003sp4
ImageMagick
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 33 CVEs
 before 7.1.1.43-150700.3.37.1
7.1.1.43-150700.3.37.1
ImageMagick
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 33 CVEs
 before 7.1.1.43-150700.3.37.1
7.1.1.43-150700.3.37.1
ImageMagick
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 31 CVEs
 before 7.1.1.21-150600.3.42.2
7.1.1.21-150600.3.42.2
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 31 CVEs
 before 7.1.1.21-150600.3.42.2
7.1.1.21-150600.3.42.2
ImageMagick
openSUSE:Leap 15.6
From an advisory covering 31 CVEs
 before 7.1.1.21-150600.3.42.2
7.1.1.21-150600.3.42.2
ImageMagick
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 27 CVEs
 before 7.1.0.9-150400.6.68.2
7.1.0.9-150400.6.68.2
ImageMagick
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 15 CVEs
 before 6.8.8.1-71.231.1
6.8.8.1-71.231.1
imagemagick
Ubuntu:Pro:14.04:LTS
 before 8:6.7.7.10-6ubuntu3.13+esm22, plus listed versions
8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu3
Show 33 moreShow less
8:6.7.7.10-6ubuntu3.18:6.7.7.10-6ubuntu3.28:6.7.7.10-6ubuntu3.38:6.7.7.10-6ubuntu3.48:6.7.7.10-6ubuntu3.58:6.7.7.10-6ubuntu3.68:6.7.7.10-6ubuntu3.78:6.7.7.10-6ubuntu3.88:6.7.7.10-6ubuntu3.98:6.7.7.10-6ubuntu3.118:6.7.7.10-6ubuntu3.128:6.7.7.10-6ubuntu3.138:6.7.7.10-6ubuntu3.13+esm18:6.7.7.10-6ubuntu3.13+esm28:6.7.7.10-6ubuntu3.13+esm38:6.7.7.10-6ubuntu3.13+esm48:6.7.7.10-6ubuntu3.13+esm58:6.7.7.10-6ubuntu3.13+esm68:6.7.7.10-6ubuntu3.13+esm78:6.7.7.10-6ubuntu3.13+esm88:6.7.7.10-6ubuntu3.13+esm98:6.7.7.10-6ubuntu3.13+esm108:6.7.7.10-6ubuntu3.13+esm118:6.7.7.10-6ubuntu3.13+esm128:6.7.7.10-6ubuntu3.13+esm138:6.7.7.10-6ubuntu3.13+esm148:6.7.7.10-6ubuntu3.13+esm158:6.7.7.10-6ubuntu3.13+esm168:6.7.7.10-6ubuntu3.13+esm178:6.7.7.10-6ubuntu3.13+esm188:6.7.7.10-6ubuntu3.13+esm198:6.7.7.10-6ubuntu3.13+esm208:6.7.7.10-6ubuntu3.13+esm21
8:6.7.7.10-6ubuntu3.13+esm22
imagemagick
Ubuntu:Pro:16.04:LTS
 before 8:6.8.9.9-7ubuntu5.16+esm21, plus listed versions
8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1
Show 39 moreShow less
8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm18:6.8.9.9-7ubuntu5.16+esm28:6.8.9.9-7ubuntu5.16+esm38:6.8.9.9-7ubuntu5.16+esm48:6.8.9.9-7ubuntu5.16+esm58:6.8.9.9-7ubuntu5.16+esm68:6.8.9.9-7ubuntu5.16+esm78:6.8.9.9-7ubuntu5.16+esm88:6.8.9.9-7ubuntu5.16+esm98:6.8.9.9-7ubuntu5.16+esm108:6.8.9.9-7ubuntu5.16+esm118:6.8.9.9-7ubuntu5.16+esm128:6.8.9.9-7ubuntu5.16+esm138:6.8.9.9-7ubuntu5.16+esm148:6.8.9.9-7ubuntu5.16+esm158:6.8.9.9-7ubuntu5.16+esm168:6.8.9.9-7ubuntu5.16+esm178:6.8.9.9-7ubuntu5.16+esm188:6.8.9.9-7ubuntu5.16+esm198:6.8.9.9-7ubuntu5.16+esm20
8:6.8.9.9-7ubuntu5.16+esm21
imagemagick
Ubuntu:Pro:18.04:LTS
 before 8:6.9.7.4+dfsg-16ubuntu6.15+esm13, plus listed versions
8:6.9.7.4+dfsg-16ubuntu28:6.9.7.4+dfsg-16ubuntu38:6.9.7.4+dfsg-16ubuntu48:6.9.7.4+dfsg-16ubuntu58:6.9.7.4+dfsg-16ubuntu6
Show 23 moreShow less
8:6.9.7.4+dfsg-16ubuntu6.28:6.9.7.4+dfsg-16ubuntu6.38:6.9.7.4+dfsg-16ubuntu6.48:6.9.7.4+dfsg-16ubuntu6.78:6.9.7.4+dfsg-16ubuntu6.88:6.9.7.4+dfsg-16ubuntu6.98:6.9.7.4+dfsg-16ubuntu6.118:6.9.7.4+dfsg-16ubuntu6.128:6.9.7.4+dfsg-16ubuntu6.138:6.9.7.4+dfsg-16ubuntu6.148:6.9.7.4+dfsg-16ubuntu6.158:6.9.7.4+dfsg-16ubuntu6.15+esm18:6.9.7.4+dfsg-16ubuntu6.15+esm28:6.9.7.4+dfsg-16ubuntu6.15+esm38:6.9.7.4+dfsg-16ubuntu6.15+esm48:6.9.7.4+dfsg-16ubuntu6.15+esm58:6.9.7.4+dfsg-16ubuntu6.15+esm68:6.9.7.4+dfsg-16ubuntu6.15+esm78:6.9.7.4+dfsg-16ubuntu6.15+esm88:6.9.7.4+dfsg-16ubuntu6.15+esm98:6.9.7.4+dfsg-16ubuntu6.15+esm108:6.9.7.4+dfsg-16ubuntu6.15+esm118:6.9.7.4+dfsg-16ubuntu6.15+esm12
8:6.9.7.4+dfsg-16ubuntu6.15+esm13
imagemagick
Ubuntu:Pro:20.04:LTS
 before 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm11, plus listed versions
8:6.9.10.23+dfsg-2.1ubuntu38:6.9.10.23+dfsg-2.1ubuntu88:6.9.10.23+dfsg-2.1ubuntu98:6.9.10.23+dfsg-2.1ubuntu108:6.9.10.23+dfsg-2.1ubuntu11
Show 25 moreShow less
8:6.9.10.23+dfsg-2.1ubuntu11.18:6.9.10.23+dfsg-2.1ubuntu11.28:6.9.10.23+dfsg-2.1ubuntu11.48:6.9.10.23+dfsg-2.1ubuntu11.4+esm18:6.9.10.23+dfsg-2.1ubuntu11.58:6.9.10.23+dfsg-2.1ubuntu11.68:6.9.10.23+dfsg-2.1ubuntu11.6+esm18:6.9.10.23+dfsg-2.1ubuntu11.78:6.9.10.23+dfsg-2.1ubuntu11.7+esm18:6.9.10.23+dfsg-2.1ubuntu11.98:6.9.10.23+dfsg-2.1ubuntu11.9+esm18:6.9.10.23+dfsg-2.1ubuntu11.9+esm28:6.9.10.23+dfsg-2.1ubuntu11.108:6.9.10.23+dfsg-2.1ubuntu11.10+esm18:6.9.10.23+dfsg-2.1ubuntu11.118:6.9.10.23+dfsg-2.1ubuntu11.11+esm18:6.9.10.23+dfsg-2.1ubuntu11.11+esm28:6.9.10.23+dfsg-2.1ubuntu11.11+esm38:6.9.10.23+dfsg-2.1ubuntu11.11+esm48:6.9.10.23+dfsg-2.1ubuntu11.11+esm58:6.9.10.23+dfsg-2.1ubuntu11.11+esm68:6.9.10.23+dfsg-2.1ubuntu11.11+esm78:6.9.10.23+dfsg-2.1ubuntu11.11+esm88:6.9.10.23+dfsg-2.1ubuntu11.11+esm98:6.9.10.23+dfsg-2.1ubuntu11.11+esm10
8:6.9.10.23+dfsg-2.1ubuntu11.11+esm11
imagemagick
Ubuntu:Pro:22.04:LTS
 before 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm11, plus listed versions
8:6.9.11.60+dfsg-1ubuntu18:6.9.11.60+dfsg-1.38:6.9.11.60+dfsg-1.3build18:6.9.11.60+dfsg-1.3build28:6.9.11.60+dfsg-1.3ubuntu0.22.04.1
Show 18 moreShow less
8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.28:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.38:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm48:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm68:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm78:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm88:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm98:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10
8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm11
imagemagick
Ubuntu:Pro:24.04:LTS
 before 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm10, plus listed versions
8:6.9.11.60+dfsg-1.6ubuntu18:6.9.12.98+dfsg1-58:6.9.12.98+dfsg1-5.2build18:6.9.12.98+dfsg1-5.2build28:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1
Show 8 moreShow less
8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm28:6.9.12.98+dfsg1-5.2ubuntu0.1~esm38:6.9.12.98+dfsg1-5.2ubuntu0.1~esm48:6.9.12.98+dfsg1-5.2ubuntu0.1~esm58:6.9.12.98+dfsg1-5.2ubuntu0.1~esm68:6.9.12.98+dfsg1-5.2ubuntu0.1~esm78:6.9.12.98+dfsg1-5.2ubuntu0.1~esm88:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9
8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm10
ImageMagick
openSUSE:Leap 16.0
From an advisory covering 38 CVEs
 before 7.1.2.0-160000.6.1
7.1.2.0-160000.6.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27799 is a medium vulnerability (CVSS 4.0) in Imagemagick, published February 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in Magick.NET-Q16-AnyCPU 14.10.3.

References

Show 88 moreShow less
This page doesn't list everything

Left out here: 1,678 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open