Vulnerabilities

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to…

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.

Read at NIST National Vulnerability Database (CVE API 2.0)

Product

ImageMagick / Ghostscript / FFmpeg / libxml2

CVSS

5.3

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-109267 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 0
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method…

   CVSS 2.5 CVE-2026-109282
2. 0
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and…

   CVSS 2.5 CVE-2026-109279
3. 0
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory…

   CVSS 3.7 CVE-2026-109278
4. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when…

   CVSS 5.3 CVE-2026-109276
5. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used.

   CVSS 4.8 CVE-2026-109275
6. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a…

   CVSS 5.3 CVE-2026-109273
7. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that…

   CVSS 5.3 CVE-2026-109269
8. 0
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000…

   CVSS 3.7 CVE-2026-109268
9. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape…

   CVSS 5.3 CVE-2026-109266 Cisco
10. 0
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack.

    CVSS 3.7 CVE-2026-109264
11. 0
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a…

    CVSS 3.7 CVE-2026-109263
12. 3
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory…

    CVSS 5.3 CVE-2026-109262
13. 0
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color…

    CVSS 3.7 CVE-2026-109261
14. 0
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng…

    CVSS 3.7 CVE-2026-109260
15. 3
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents.

    CVSS 5.3 CVE-2026-109259