{"id":"CVE-2026-55577","aliases":["ALPINE-CVE-2026-55577","DEBIAN-CVE-2026-55577","EUVD-2026-41121","GHSA-wx47-rm3x-jx6p","JLSEC-2026-1037","MGASA-2026-0252","OESA-2026-2853","OESA-2026-2854","OESA-2026-2855","OESA-2026-2856","ROOT-OS-DEBIAN-12-CVE-2026-55577","UBUNTU-CVE-2026-55577","openSUSE-SU-2026:11228-1"],"status":"published","title":"ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00226,"percentile":0.1342,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-754","CWE-755","CWE-787"],"published":"2026-07-01T18:56:28Z","modified":"2026-11-03T06:33:05Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"imagemagick","fixed_in":["7.1.2.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"imagemagick","fixed_in":["7.1.2.27-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.11.60+dfsg-1.6+deb12u12"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:7.1.1.43+dfsg1-1+deb13u11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:7.1.2.26+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"ImageMagick_jll","fixed_in":["7.1.2028+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0-0"},{"fixed":"7.1.2.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0-0"},{"fixed":"7.1.2.27-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.6+deb12u12"}]}],"versions":["8:6.9.11.60+dfsg-1.6","8:6.9.11.60+dfsg-1.6+deb12u1","8:6.9.11.60+dfsg-1.6+deb12u10","8:6.9.11.60+dfsg-1.6+deb12u11","8:6.9.11.60+dfsg-1.6+deb12u2","8:6.9.11.60+dfsg-1.6+deb12u3","8:6.9.11.60+dfsg-1.6+deb12u4","8:6.9.11.60+dfsg-1.6+deb12u5","8:6.9.11.60+dfsg-1.6+deb12u6","8:6.9.11.60+dfsg-1.6+deb12u7","8:6.9.11.60+dfsg-1.6+deb12u8","8:6.9.11.60+dfsg-1.6+deb12u9"]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.1.43+dfsg1-1+deb13u11"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.43+dfsg1-1+deb13u1","8:7.1.1.43+dfsg1-1+deb13u10","8:7.1.1.43+dfsg1-1+deb13u2","8:7.1.1.43+dfsg1-1+deb13u3","8:7.1.1.43+dfsg1-1+deb13u4","8:7.1.1.43+dfsg1-1+deb13u5","8:7.1.1.43+dfsg1-1+deb13u6","8:7.1.1.43+dfsg1-1+deb13u7","8:7.1.1.43+dfsg1-1+deb13u8","8:7.1.1.43+dfsg1-1+deb13u9"]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.2.26+dfsg1-1"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.46+dfsg1-1","8:7.1.1.47+dfsg1-1","8:7.1.1.47+dfsg1-2","8:7.1.2.1+dfsg1-1","8:7.1.2.12+dfsg1-1","8:7.1.2.13+dfsg1-1","8:7.1.2.15+dfsg1-1","8:7.1.2.15+dfsg1-2","8:7.1.2.16+dfsg1-1","8:7.1.2.18+dfsg1-1","8:7.1.2.19+dfsg1-1","8:7.1.2.21+dfsg1-1","8:7.1.2.23+dfsg1-1","8:7.1.2.24+dfsg1-1","8:7.1.2.25+dfsg1-1","8:7.1.2.25+dfsg1-2","8:7.1.2.3+dfsg1-1","8:7.1.2.7+dfsg1-1","8:7.1.2.8+dfsg1-1"]},{"source":"osv","ecosystem":"Julia","package":"ImageMagick_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.2028+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.27-1.mga10"}]}],"bundled":21},{"source":"osv","ecosystem":"Mageia:10","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.27-1.mga10.tainted"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.13.51-1.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.26-1.oe2203sp4"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.26-1.oe2403sp1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.26-1.oe2403sp3"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3","8:6.7.7.10-6ubuntu3.1","8:6.7.7.10-6ubuntu3.2","8:6.7.7.10-6ubuntu3.3","8:6.7.7.10-6ubuntu3.4","8:6.7.7.10-6ubuntu3.5","8:6.7.7.10-6ubuntu3.6","8:6.7.7.10-6ubuntu3.7","8:6.7.7.10-6ubuntu3.8","8:6.7.7.10-6ubuntu3.9","8:6.7.7.10-6ubuntu3.11","8:6.7.7.10-6ubuntu3.12","8:6.7.7.10-6ubuntu3.13","8:6.7.7.10-6ubuntu3.13+esm1","8:6.7.7.10-6ubuntu3.13+esm2","8:6.7.7.10-6ubuntu3.13+esm3","8:6.7.7.10-6ubuntu3.13+esm4","8:6.7.7.10-6ubuntu3.13+esm5","8:6.7.7.10-6ubuntu3.13+esm6","8:6.7.7.10-6ubuntu3.13+esm7","8:6.7.7.10-6ubuntu3.13+esm8","8:6.7.7.10-6ubuntu3.13+esm9","8:6.7.7.10-6ubuntu3.13+esm10","8:6.7.7.10-6ubuntu3.13+esm11","8:6.7.7.10-6ubuntu3.13+esm12","8:6.7.7.10-6ubuntu3.13+esm13","8:6.7.7.10-6ubuntu3.13+esm14","8:6.7.7.10-6ubuntu3.13+esm15","8:6.7.7.10-6ubuntu3.13+esm16","8:6.7.7.10-6ubuntu3.13+esm17","8:6.7.7.10-6ubuntu3.13+esm18","8:6.7.7.10-6ubuntu3.13+esm19","8:6.7.7.10-6ubuntu3.13+esm20","8:6.7.7.10-6ubuntu3.13+esm21","8:6.7.7.10-6ubuntu3.13+esm22","8:6.7.7.10-6ubuntu3.13+esm23","8:6.7.7.10-6ubuntu3.13+esm24","8:6.7.7.10-6ubuntu3.13+esm25","8:6.7.7.10-6ubuntu3.13+esm26","8:6.7.7.10-6ubuntu3.13+esm27"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5","8:6.8.9.9-7ubuntu5.1","8:6.8.9.9-7ubuntu5.2","8:6.8.9.9-7ubuntu5.3","8:6.8.9.9-7ubuntu5.4","8:6.8.9.9-7ubuntu5.5","8:6.8.9.9-7ubuntu5.6","8:6.8.9.9-7ubuntu5.7","8:6.8.9.9-7ubuntu5.8","8:6.8.9.9-7ubuntu5.9","8:6.8.9.9-7ubuntu5.11","8:6.8.9.9-7ubuntu5.12","8:6.8.9.9-7ubuntu5.13","8:6.8.9.9-7ubuntu5.14","8:6.8.9.9-7ubuntu5.15","8:6.8.9.9-7ubuntu5.16","8:6.8.9.9-7ubuntu5.16+esm1","8:6.8.9.9-7ubuntu5.16+esm2","8:6.8.9.9-7ubuntu5.16+esm3","8:6.8.9.9-7ubuntu5.16+esm4","8:6.8.9.9-7ubuntu5.16+esm5","8:6.8.9.9-7ubuntu5.16+esm6","8:6.8.9.9-7ubuntu5.16+esm7","8:6.8.9.9-7ubuntu5.16+esm8","8:6.8.9.9-7ubuntu5.16+esm9","8:6.8.9.9-7ubuntu5.16+esm10","8:6.8.9.9-7ubuntu5.16+esm11","8:6.8.9.9-7ubuntu5.16+esm12","8:6.8.9.9-7ubuntu5.16+esm13","8:6.8.9.9-7ubuntu5.16+esm14","8:6.8.9.9-7ubuntu5.16+esm15","8:6.8.9.9-7ubuntu5.16+esm16","8:6.8.9.9-7ubuntu5.16+esm17","8:6.8.9.9-7ubuntu5.16+esm18","8:6.8.9.9-7ubuntu5.16+esm19","8:6.8.9.9-7ubuntu5.16+esm20","8:6.8.9.9-7ubuntu5.16+esm21","8:6.8.9.9-7ubuntu5.16+esm22","8:6.8.9.9-7ubuntu5.16+esm23","8:6.8.9.9-7ubuntu5.16+esm24","8:6.8.9.9-7ubuntu5.16+esm25","8:6.8.9.9-7ubuntu5.16+esm26"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.7.4+dfsg-16ubuntu2","8:6.9.7.4+dfsg-16ubuntu3","8:6.9.7.4+dfsg-16ubuntu4","8:6.9.7.4+dfsg-16ubuntu5","8:6.9.7.4+dfsg-16ubuntu6","8:6.9.7.4+dfsg-16ubuntu6.2","8:6.9.7.4+dfsg-16ubuntu6.3","8:6.9.7.4+dfsg-16ubuntu6.4","8:6.9.7.4+dfsg-16ubuntu6.7","8:6.9.7.4+dfsg-16ubuntu6.8","8:6.9.7.4+dfsg-16ubuntu6.9","8:6.9.7.4+dfsg-16ubuntu6.11","8:6.9.7.4+dfsg-16ubuntu6.12","8:6.9.7.4+dfsg-16ubuntu6.13","8:6.9.7.4+dfsg-16ubuntu6.14","8:6.9.7.4+dfsg-16ubuntu6.15","8:6.9.7.4+dfsg-16ubuntu6.15+esm1","8:6.9.7.4+dfsg-16ubuntu6.15+esm2","8:6.9.7.4+dfsg-16ubuntu6.15+esm3","8:6.9.7.4+dfsg-16ubuntu6.15+esm4","8:6.9.7.4+dfsg-16ubuntu6.15+esm5","8:6.9.7.4+dfsg-16ubuntu6.15+esm6","8:6.9.7.4+dfsg-16ubuntu6.15+esm7","8:6.9.7.4+dfsg-16ubuntu6.15+esm8","8:6.9.7.4+dfsg-16ubuntu6.15+esm9","8:6.9.7.4+dfsg-16ubuntu6.15+esm10","8:6.9.7.4+dfsg-16ubuntu6.15+esm11","8:6.9.7.4+dfsg-16ubuntu6.15+esm12","8:6.9.7.4+dfsg-16ubuntu6.15+esm13","8:6.9.7.4+dfsg-16ubuntu6.15+esm14","8:6.9.7.4+dfsg-16ubuntu6.15+esm15","8:6.9.7.4+dfsg-16ubuntu6.15+esm16","8:6.9.7.4+dfsg-16ubuntu6.15+esm17","8:6.9.7.4+dfsg-16ubuntu6.15+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.10.23+dfsg-2.1ubuntu3","8:6.9.10.23+dfsg-2.1ubuntu8","8:6.9.10.23+dfsg-2.1ubuntu9","8:6.9.10.23+dfsg-2.1ubuntu10","8:6.9.10.23+dfsg-2.1ubuntu11","8:6.9.10.23+dfsg-2.1ubuntu11.1","8:6.9.10.23+dfsg-2.1ubuntu11.2","8:6.9.10.23+dfsg-2.1ubuntu11.4","8:6.9.10.23+dfsg-2.1ubuntu11.4+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.5","8:6.9.10.23+dfsg-2.1ubuntu11.6","8:6.9.10.23+dfsg-2.1ubuntu11.6+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.7","8:6.9.10.23+dfsg-2.1ubuntu11.7+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.10","8:6.9.10.23+dfsg-2.1ubuntu11.10+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm3","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm4","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm5","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm6","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm7","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm8","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm9","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm10","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm11","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm12","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm13","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm14","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm15","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.11.60+dfsg-1ubuntu1","8:6.9.11.60+dfsg-1.3","8:6.9.11.60+dfsg-1.3build1","8:6.9.11.60+dfsg-1.3build2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm4","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm6","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm7","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm8","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm9","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm11","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm12","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm13","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm14","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.11.60+dfsg-1.6ubuntu1","8:6.9.12.98+dfsg1-5","8:6.9.12.98+dfsg1-5.2build1","8:6.9.12.98+dfsg1-5.2build2","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm2","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm5","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm6","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm7","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm8","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm10","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm11","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm12","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm13","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm14","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.43+dfsg1-1ubuntu1","8:7.1.1.43+dfsg1-1ubuntu2","8:7.1.2.3+dfsg1-1","8:7.1.2.3+dfsg1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:7.1.2.18+dfsg1-1","8:7.1.2.25+dfsg1-2","8:7.1.2.27+dfsg1-1","8:7.1.2.31+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:7.1.2.3+dfsg1-1","8:7.1.2.8+dfsg1-1","8:7.1.2.12+dfsg1-1","8:7.1.2.13+dfsg1-1","8:7.1.2.15+dfsg1-1","8:7.1.2.16+dfsg1-1","8:7.1.2.18+dfsg1-1","8:7.1.2.18+dfsg1-1ubuntu0.1~esm1","8:7.1.2.18+dfsg1-1ubuntu0.1~esm2","8:7.1.2.18+dfsg1-1ubuntu0.1~esm3","8:7.1.2.18+dfsg1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.27-1.1"}]}],"bundled":15}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wx47-rm3x-jx6p","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-55577","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55577.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55577","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55577","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0252.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35866","tags":["report"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2hhq-c99x-492r","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h36c-3666-h489","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5v62-8fq6-cp9m","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67p","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xcjm-wqff-m669","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4v89-6mgq-6rgc","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-px7q-ggqj-hcf2","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p9rq-q46c-g4x6","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j989-f892-2335","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-44cp-c3ww-9rv5","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pjxj-pchx-4c3m","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h5r4-w88w-7ccr","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r628-69v2-2f9c","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h7f2-f9cc-h2gv","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jfq9-q63x-rc63","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-99w9-hv66-rfv7","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j8rh-v2r8-v94x","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7c7m-fpjw-gwcq","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6vxp-gfwf-hcr9","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hwf3-r46v-5ggx","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8g53-9m3c-69xg","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-ff5c-8x9r-8qcw","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vghg-5jrg-2398","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-82mp-vp5c-9pf7","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v3j6-27vc-7pw2","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh5g-q395-cx4j","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-c4v7-w88g-m6c4","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hc76-7mpc-qjqh","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qhmf-7fc4-8q3h","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56m6-8q75-f2rw","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvhp-75f6-9jqh","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mx48-2qq3-23hf","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-76q6-2p6h-xjqr","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55510","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55628","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55597","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2855","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2856","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55577","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56377","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-55577","title":"ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.","status":"published","published":"2026-07-01T18:56:28.768Z","modified":"2026-07-01T19:24:45.452Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-754","CWE-755","CWE-787"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-41121","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.","status":"published","published":"2026-07-01T18:56:28Z","modified":"2026-07-01T19:24:45Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:18.588227Z"}],"nvd":[{"id":"CVE-2026-55577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.","status":"published","published":"2026-07-01T19:16:54.907Z","modified":"2026-07-02T19:30:48.277Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-754","CWE-755","CWE-787"],"updated_at":"2026-11-02T14:12:27.199837Z"}],"osv":[{"id":"ALPINE-CVE-2026-55577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.","status":"published","published":"2026-07-01T19:16:54.907Z","modified":"2026-11-03T06:33:05.799734085Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"CVE-2026-55577","title":"ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.","status":"published","published":"2026-07-01T18:56:28.768Z","modified":"2026-10-28T02:31:01.161914827Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-754","CWE-755","CWE-787"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"DEBIAN-CVE-2026-55577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.","status":"published","published":"2026-07-01T19:16:54.907Z","modified":"2026-10-01T03:03:26.804973476Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"JLSEC-2026-1037","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.","status":"published","published":"2026-07-30T16:02:27.435Z","modified":"2026-07-30T18:23:30.241407665Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2853","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-53466)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-53467)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55510)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55577)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55594)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55595)\n\nIn versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.(CVE-2026-55628)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:14.033776623Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2854","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-53466)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-53467)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55510)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55577)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55594)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55595)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.(CVE-2026-55597)\n\nIn versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.(CVE-2026-55628)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:14.078658626Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2855","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-53466)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-53467)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55510)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55577)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55594)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55595)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.(CVE-2026-55597)\n\nIn versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.(CVE-2026-55628)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:13.919579384Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2856","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\r\n\r\nSecurity Fix(es):\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-53466)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-53467)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55510)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55577)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55594)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.(CVE-2026-55595)\n\nImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.(CVE-2026-55597)\n\nIn versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.(CVE-2026-55628)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:14.296329157Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-55577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.","status":"published","published":"2026-07-01T19:16:00Z","modified":"2026-10-17T12:59:08.470753804Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"MGASA-2026-0252","title":"Updated imagemagick packages fix security vulnerabilities","description":"The updated packages fix numerous security vulnerabilities:\nCode injection in HTML encoder due to incomplete fix of CVE-2026-25797.\n(CVE-2026-25797)\nHeap Buffer Underwrite in Floyd-Steinberg depth dithering.\n(CVE-2026-48724)\nInfinite Loop in subimage-search with crafted image. (CVE-2026-48733)\nStack Overflow in MVG decoder. (CVE-2026-48734)\nPolicy Bypass in DCM decoder could result in image with invalid\ndimensions. (CVE-2026-49218)\nPolicy Bypass can read disallowed files. (CVE-2026-49219)\nHeap Buffer Over-Write in MAT decoder on 32-bit systems.\n(CVE-2026-48994)\nPolicy Bypass can trigger out-of-Memory condition. (CVE-2026-53460)\nHeap Buffer Over-Write in ICON decoder due to incorrect loop.\n(CVE-2026-53461)\nUse-After-Free when allocation in CheckPrimitiveExtent fails.\n(CVE-2026-53462)\nNull Pointer Dereference in distort operation when passing incorrect\narguments. (CVE-2026-53463)\nMemory Leak in wand option parser when providing invalid arguments.\n(CVE-2026-53464)\nHeap Buffer Over-Write in SF3 encoder when writing multi-frame image.\n(CVE-2026-53465)\nHeap Buffer Over-Read in XCF decoder due to integer conversion overflow.\n(CVE-2026-53466)\nInformation Disclosure in MNG decoder because allocated memory is left\nunchanged. (CVE-2026-53467)\nUse-After-Free in crafted 8BIM when identifying an image.\n(CVE-2026-55510)\nHeap Buffer Overflow in ImageMagick MVG decoder. (CVE-2026-55577)\nStack Overflow in MVG decoder due to missing depth check.\n(CVE-2026-55594)\nInfinite Loop in connected-components when providing invalid arguments.\n(CVE-2026-55595)\nHeap Buffer Over-Write in JP2 encoder when due to incorrect handling of\narguments. (CVE-2026-55597)\nPolicy Bypass in concatenate operation due to missing checks.\n(CVE-2026-55628)\n","status":"published","published":"2026-07-14T16:40:11Z","modified":"2026-07-14T16:50:08.337937836Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11228-1","title":"ImageMagick-7.1.2.27-1.1 on GA media","description":"These are all security issues fixed in the ImageMagick-7.1.2.27-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:09.156333363Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-55577","title":"CVE-2026-55577 in rootio-imagemagick - Patched by Root","description":"Root has patched CVE-2026-55577 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-08T06:49:48Z","modified":"2026-07-17T20:00:16.974874781Z","updated_at":"2026-11-02T15:53:32.298225Z"}]}}