Vulnerabilities

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000…

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process.

Read at NIST National Vulnerability Database (CVE API 2.0)

Product

ImageMagick / Ghostscript / FFmpeg / libxml2

CVSS

3.7

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-109268 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 0
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method…

   CVSS 2.5 CVE-2026-109282
2. 0
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and…

   CVSS 2.5 CVE-2026-109279
3. 0
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory…

   CVSS 3.7 CVE-2026-109278
4. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when…

   CVSS 5.3 CVE-2026-109276
5. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used.

   CVSS 4.8 CVE-2026-109275
6. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a…

   CVSS 5.3 CVE-2026-109273
7. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that…

   CVSS 5.3 CVE-2026-109269
8. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to…

   CVSS 5.3 CVE-2026-109267
9. 3
   CVE NVD 26d ago

   ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape…

   CVSS 5.3 CVE-2026-109266 Cisco
10. 0
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack.

    CVSS 3.7 CVE-2026-109264
11. 0
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a…

    CVSS 3.7 CVE-2026-109263
12. 3
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory…

    CVSS 5.3 CVE-2026-109262
13. 0
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color…

    CVSS 3.7 CVE-2026-109261
14. 0
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng…

    CVSS 3.7 CVE-2026-109260
15. 3
    CVE NVD 26d ago

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents.

    CVSS 5.3 CVE-2026-109259