Vulnerabilities in ImageMagick

188 results
Vexday analysis

Com 134 CVEs catalogadas e nenhuma presença no catálogo KEV da CISA, o ImageMagick apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere baixa pressão de ameaças imediatas no momento. No entanto, chama atenção o volume de 48 vulnerabilidades surgidas nos últimos 90 dias, indicando ritmo elevado de descobertas recentes que requer acompanhamento contínuo. O tipo de falha mais frequente é CWE-122 (heap-based buffer overflow), classe de fraqueza que historicamente favorece execução de código e merece atenção prioritária em ambientes que processam imagens de origem não confiável. A CVE mais perigosa ativa no momento, CVE-2025-55298, possui EPSS de 0,041 e é a única com PoC pública disponível, representando o ponto de atenção mais concreto para equipes de remediação.

CVE-2026-53461HIGHImageMagick: Out-of-bounds write in ICON decoder due to incorrect loopEPSS 0.4%CVE-2026-25898MEDIUMImagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM WriterEPSS 0.3%CVE-2026-49218HIGHImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensionsEPSS 0.3%CVE-2026-53460HIGHImageMagick: Policy Bypass can trigger out-of-Memory conditionEPSS 0.3%CVE-2025-62594MEDIUMImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)EPSS 0.3%CVE-2026-25982MEDIUMImageMagick Has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)EPSS 0.3%CVE-2026-28693HIGHImageMagick has an integer overflow in DIB coder can result in out of bounds read or writeEPSS 0.3%CVE-2026-53467MEDIUMImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchangedEPSS 0.3%CVE-2026-26066MEDIUMImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profileEPSS 0.3%CVE-2026-26283MEDIUMImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent`EPSS 0.3%CVE-2026-25638MEDIUMImageMagick has memory leak in msl encoderEPSS 0.3%CVE-2026-61861MEDIUMImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaptionEPSS 0.3%CVE-2026-86420MEDIUMImageMagick before 7.1.2-30 Denial of Service Memory BudgetEPSS 0.3%CVE-2026-56376MEDIUMImageMagick - Heap Use-After-Free in Meta CoderEPSS 0.3%CVE-2026-25967HIGHImageMagick has stack buffer overflow in FTXT reader via oversized integer fieldEPSS 0.3%CVE-2026-93590MEDIUMImageMagick before 7.1.2-31 Policy Bypass in UHDR encoderEPSS 0.3%CVE-2026-25897MEDIUMImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds writeEPSS 0.3%CVE-2026-46523MEDIUMImageMagick: Use-After-Free in MSL decoder.EPSS 0.3%CVE-2026-56369MEDIUMImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImageEPSS 0.3%CVE-2025-57807LOWImageMagick BlobStream Forward-Seek Under-AllocationEPSS 0.3%