ImageMagick: 25 Vulnerabilities Disclosed, Affecting Multiple Image Formats
Key findings • 25 medium-severity vulnerabilities disclosed for ImageMagick between Oct 7-8, 2026. • Issues span multiple decoders (CALS, MAT, MVG, RSVG) and encoders (CUT, PostScript). •…
Key findings
- 25 medium-severity vulnerabilities disclosed for ImageMagick between Oct 7-8, 2026.
- Issues span multiple decoders (CALS, MAT, MVG, RSVG) and encoders (CUT, PostScript).
- Vulnerabilities primarily lead to denial-of-service, with some policy bypass and code injection risks.
- Affected versions include ImageMagick prior to 7.1.2-30 and 6.9.13-55.
- Patched versions include 7.1.2-31 and 6.9.13-56.
On October 7-8, 2026, a significant batch of 25 medium-severity vulnerabilities was disclosed for ImageMagick, a widely used open-source image processing suite. These vulnerabilities, spanning various components and functions within the software, primarily lead to denial-of-service conditions, with some also posing risks of policy bypass and code injection. The coordinated disclosure highlights potential weaknesses across multiple image format decoders and encoders, underscoring the need for prompt patching by users.
Several vulnerabilities stem from improper handling of specific image formats. For instance, the CALS decoder is affected by uncontrolled recursion due to a missing depth check (CVE-2026-105827, CVE-2026-106572), which can exhaust the stack and crash the process. Similarly, the MAT decoder (CVE-2026-105826, CVE-2026-107210) and the MVG decoder (CVE-2026-105406, CVE-2026-106573, CVE-2026-106578) suffer from issues related to resource limits and memory handling, leading to denial of service or crashes. The RSVG decoder also presents a use-after-free vulnerability when built without Cairo support (CVE-2026-105824, CVE-2026-107209).
Other vulnerabilities target specific functionalities like XMP profile handling and PostScript encoding. A crafted XMP profile can lead to denial of service by triggering a fatal condition instead of an exception (CVE-2026-105825, CVE-2026-107208) or by causing excessive work during rational value parsing (CVE-2026-105402). The PostScript coders are susceptible to code injection due to unescaped or untrimmed values (CVE-2026-105404, CVE-2026-106577).
Security policy bypasses are also a concern. CVE-2026-105823 and CVE-2026-106576 detail a missing security policy check in the CUT encoder, allowing potential data reads and crashes. Furthermore, CVE-2026-105403 and CVE-2026-106579 describe how crafted images can bypass security policies that use coder as their domain, enabling the processing of formats that administrators intended to block.
The batch also includes vulnerabilities related to heap buffer overflows and resource leaks. CVE-2026-105401 and CVE-2026-106574 highlight heap buffer overflows in the distributed pixel cache server, allowing attackers to overwrite memory. CVE-2026-105399 describes a resource leak in magick scripts, where file pointers remain open, potentially exhausting file descriptors. CVE-2026-105398 points to a heap buffer overflow in the GetVirtualPixels API.
The disclosed vulnerabilities affect ImageMagick versions prior to 7.1.2-30 and 6.9.13-55, with some specific fixes in 7.1.2-31 and 6.9.13-56. Users are strongly advised to update to the patched versions to mitigate these risks. The broad nature of these vulnerabilities, affecting multiple components and attack vectors, emphasizes the importance of regular security audits and timely updates for systems relying on ImageMagick for image processing.
This coordinated disclosure of 25 vulnerabilities across various ImageMagick components serves as a critical reminder for developers and system administrators to maintain up-to-date software. The range of issues, from denial-of-service to policy bypass and potential code injection, necessitates a thorough review of security configurations and prompt application of patches. Staying informed about such disclosure events and prioritizing updates is crucial for maintaining a secure operating environment.