{"url":"http://public2.vulnerablecode.io/api/packages/66691?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.9.1","type":"nuget","namespace":"","name":"Magick.NET-Q16-HDRI-OpenMP-x64","version":"14.9.1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"14.11.0","latest_non_vulnerable_version":"14.12.0","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22040?format=json","vulnerability_id":"VCID-15ny-qqbj-qyfk","summary":"ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile\nA crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26066.json","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26066.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26066","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04844","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04599","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04623","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04635","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04669","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0468","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04675","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04658","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04641","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04608","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04617","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04757","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04791","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0483","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26066"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26066","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26066"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/880057ce34f6da9dff2fe3b290bbbc45b743e613","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/880057ce34f6da9dff2fe3b290bbbc45b743e613"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442142","reference_id":"2442142","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442142"},{"reference_url":"https://github.com/advisories/GHSA-v994-63cg-9wj3","reference_id":"GHSA-v994-63cg-9wj3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v994-63cg-9wj3"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-26066","GHSA-v994-63cg-9wj3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-15ny-qqbj-qyfk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22659?format=json","vulnerability_id":"VCID-1cpn-zvem-v7gt","summary":"ImageMagick has uninitialized pointer dereference in JBIG decoder\nAn uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28691.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28691.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28691","reference_id":"","reference_type":"","scores":[{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17322","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17474","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17542","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17495","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17414","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.1883","published_at":"2026-04-16T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18877","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18928","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18682","published_at":"2026-04-29T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18725","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18746","published_at":"2026-04-24T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18858","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18843","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18975","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28691"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28691","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28691"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T15:58:48Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445902","reference_id":"2445902","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445902"},{"reference_url":"https://github.com/advisories/GHSA-wj8w-pjxf-9g4f","reference_id":"GHSA-wj8w-pjxf-9g4f","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wj8w-pjxf-9g4f"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:6713","reference_id":"RHSA-2026:6713","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:6713"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28691","GHSA-wj8w-pjxf-9g4f"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1cpn-zvem-v7gt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22155?format=json","vulnerability_id":"VCID-29r3-kvf4-n3hc","summary":"ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images\nA heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator.\n\n```\n==3693336==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000001280 at pc 0x5602c8b0cc75 bp 0x7ffcb105d510 sp 0x7ffcb105d500\nREAD of size 4 at 0x511000001280 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27798.json","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27798.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27798","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02733","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02854","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02796","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02808","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02818","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02704","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02694","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.0274","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02743","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02713","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02717","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02763","published_at":"2026-04-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27798"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27798","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27798"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T16:54:43Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/0377e60b3c0d766bd7271221c95d9ee54f6a3738","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T16:54:43Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/0377e60b3c0d766bd7271221c95d9ee54f6a3738"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T16:54:43Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27798","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27798"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442872","reference_id":"2442872","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442872"},{"reference_url":"https://github.com/advisories/GHSA-qpgx-jfcq-r59f","reference_id":"GHSA-qpgx-jfcq-r59f","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qpgx-jfcq-r59f"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-27798","GHSA-qpgx-jfcq-r59f"],"risk_score":3.2,"exploitability":"0.5","weighted_severity":"6.4","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-29r3-kvf4-n3hc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24115?format=json","vulnerability_id":"VCID-2gw3-qfan-jygd","summary":"ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack\nUsing Magick to read a malicious SVG file resulted in a DoS attack.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68618.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68618.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68618","reference_id":"","reference_type":"","scores":[{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.2751","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27584","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27692","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.2775","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27794","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27816","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27867","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.28008","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.278","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27908","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27809","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27966","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27868","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.2791","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68618"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68618","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68618"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:57Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426285","reference_id":"2426285","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426285"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","reference_id":"CVE-2025-68618","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618"},{"reference_url":"https://github.com/advisories/GHSA-p27m-hp98-6637","reference_id":"GHSA-p27m-hp98-6637","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p27m-hp98-6637"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637","reference_id":"GHSA-p27m-hp98-6637","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:57Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"},{"reference_url":"https://usn.ubuntu.com/8007-1/","reference_id":"USN-8007-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8007-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67195?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bd1g-sfsp-37h7"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-z9t9-bxf9-hkfk"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.1"}],"aliases":["CVE-2025-68618","GHSA-p27m-hp98-6637"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2gw3-qfan-jygd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24037?format=json","vulnerability_id":"VCID-2zje-ag2v-7kac","summary":"ImageMagick has heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation\nA 32-bit unsigned integer overflow in the XWD (X Windows) encoder can cause an undersized heap buffer allocation. When writing a extremely large image an out of bounds heap write can occur.\n\n```\n=================================================================\n==741961==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020000083dc at pc 0x56553b4c4245 bp 0x7ffd9d20fef0 sp 0x7ffd9d20fee0\nWRITE of size 1 at 0x5020000083dc thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30937.json","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30937.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30937","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02792","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02773","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.0277","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02764","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02749","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04047","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03919","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03902","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03875","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03854","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03864","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03984","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03996","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04002","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30937"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30937","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30937"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpg4-j99f-8xcg","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:34:45Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpg4-j99f-8xcg"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30937","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30937"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445882","reference_id":"2445882","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445882"},{"reference_url":"https://github.com/advisories/GHSA-qpg4-j99f-8xcg","reference_id":"GHSA-qpg4-j99f-8xcg","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qpg4-j99f-8xcg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-30937","GHSA-qpg4-j99f-8xcg"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2zje-ag2v-7kac"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24252?format=json","vulnerability_id":"VCID-54da-fzyt-4ud2","summary":"ImageMagick has stack write buffer overflow in MNG encoder\nA stack buffer overflow vulnerability exists in the MNG encoder. There is a bounds checks missing that could corrupting the stack with attacker-controlled data.\n\n```\n==2265506==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffec4971310 at pc 0x55e671b8a072 bp 0x7ffec4970f70 sp 0x7ffec4970f68\nWRITE of size 1 at 0x7ffec4971310 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28690.json","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28690.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28690","reference_id":"","reference_type":"","scores":[{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02324","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02321","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02326","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02346","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02316","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02837","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02973","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02924","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02937","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02943","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02826","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02817","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02856","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02832","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28690"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28690","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28690"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7h7q-j33q-hvpf","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T15:58:08Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7h7q-j33q-hvpf"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28690","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28690"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445887","reference_id":"2445887","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445887"},{"reference_url":"https://github.com/advisories/GHSA-7h7q-j33q-hvpf","reference_id":"GHSA-7h7q-j33q-hvpf","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7h7q-j33q-hvpf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28690","GHSA-7h7q-j33q-hvpf"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-54da-fzyt-4ud2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20782?format=json","vulnerability_id":"VCID-569d-6nue-5kbq","summary":"ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails\nThe BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22770.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22770.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22770","reference_id":"","reference_type":"","scores":[{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20822","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20855","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20898","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.21028","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20743","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20883","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20613","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20647","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20651","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.2077","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20785","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20793","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20803","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.2097","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22770"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-21T20:05:17Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3c","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-21T20:05:17Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3c"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22770","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22770"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126074","reference_id":"1126074","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126074"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431037","reference_id":"2431037","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431037"},{"reference_url":"https://github.com/advisories/GHSA-39h3-g67r-7g3c","reference_id":"GHSA-39h3-g67r-7g3c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-39h3-g67r-7g3c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61604?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bd1g-sfsp-37h7"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-z9t9-bxf9-hkfk"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.2"}],"aliases":["CVE-2026-22770","GHSA-39h3-g67r-7g3c"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-569d-6nue-5kbq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21069?format=json","vulnerability_id":"VCID-5uyd-bv33-h7g1","summary":"ImageMagick: Heap overflow in sun decoder on 32-bit systems may result in out of bounds write\nAn Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write.\n\n```\n=================================================================\n==1967675==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf190b50e at pc 0x5eae8777 bp 0xffb0fdd8 sp 0xffb0fdd0\nWRITE of size 1 at 0xf190b50e thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25897.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25897.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25897","reference_id":"","reference_type":"","scores":[{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.0608","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06044","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06013","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06084","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19295","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.1929","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19237","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19158","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.1939","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19441","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19162","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19153","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19194","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19248","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25897"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25897","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25897"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/23fde73188ea32c15b607571775d4f92bdb75e60","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/23fde73188ea32c15b607571775d4f92bdb75e60"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:23:43Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442098","reference_id":"2442098","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442098"},{"reference_url":"https://github.com/advisories/GHSA-6j5f-24fw-pqp4","reference_id":"GHSA-6j5f-24fw-pqp4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6j5f-24fw-pqp4"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25897","GHSA-6j5f-24fw-pqp4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5uyd-bv33-h7g1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/25110?format=json","vulnerability_id":"VCID-5zkt-kcgx-a3e2","summary":"ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption\nA signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows.\n\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==143838==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000\n    #0 0x7f379d5adb53  (/lib/x86_64-linux-gnu/libc.so.6+0xc4b53)\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25970.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25970.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25970","reference_id":"","reference_type":"","scores":[{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17646","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17743","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17831","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17892","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17908","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17864","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17815","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17757","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17767","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17805","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17714","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.1769","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17989","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18043","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25970"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25970","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25970"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25970","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25970"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442108","reference_id":"2442108","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442108"},{"reference_url":"https://github.com/advisories/GHSA-xg29-8ghv-v4xr","reference_id":"GHSA-xg29-8ghv-v4xr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xg29-8ghv-v4xr"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25970","GHSA-xg29-8ghv-v4xr"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5zkt-kcgx-a3e2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21856?format=json","vulnerability_id":"VCID-62ar-kwbq-nyh3","summary":"ImageMagick has memory leak in msl encoder\nMemory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. \n\n```\n==78983== Memcheck, a memory error detector\n==78983== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.\n==78983== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info\n==78983== \n==78983== 177,196 (13,512 direct, 163,684 indirect) bytes in 1 blocks are definitely lost in loss record 21 of 21\n==78983==    at 0x4846828: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25638.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25638.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25638","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05154","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05112","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05082","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04934","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04924","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04978","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04997","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05015","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05035","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05019","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04986","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04968","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18616","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25638"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25638","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25638"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/1e88fca11c7b8517100d518bc99bd8c474f02f88","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/1e88fca11c7b8517100d518bc99bd8c474f02f88"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442105","reference_id":"2442105","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442105"},{"reference_url":"https://github.com/advisories/GHSA-gxcx-qjqp-8vjw","reference_id":"GHSA-gxcx-qjqp-8vjw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gxcx-qjqp-8vjw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25638","GHSA-gxcx-qjqp-8vjw"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-62ar-kwbq-nyh3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21784?format=json","vulnerability_id":"VCID-69f6-ceje-hyah","summary":"ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS\nThe PCD coder’s DecodeImage loop allows a crafted PCD file to trigger a 1‑byte heap out-of-bounds read when decoding an image (Denial of service) and potential disclosure of adjacent heap byte.","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9"},{"reference_url":"https://github.com/advisories/GHSA-wgxp-q8xq-wpp9","reference_id":"GHSA-wgxp-q8xq-wpp9","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wgxp-q8xq-wpp9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["GHSA-wgxp-q8xq-wpp9"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-69f6-ceje-hyah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24835?format=json","vulnerability_id":"VCID-6h7x-3rue-kucp","summary":"ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder\nIn MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read.\n\n```\n=================================================================\n==969652==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506000003b40 at pc 0x555557b2a926 bp 0x7fffffff4c80 sp 0x7fffffff4c70\nREAD of size 8 at 0x506000003b40 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28692.json","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28692.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28692","reference_id":"","reference_type":"","scores":[{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05647","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05608","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05673","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05611","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05574","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06128","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06304","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06291","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06264","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06248","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.061","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06089","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06139","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06135","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28692"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28692","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28692"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mrmj-x24c-wwcv","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T15:58:29Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mrmj-x24c-wwcv"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28692","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28692"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445890","reference_id":"2445890","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445890"},{"reference_url":"https://github.com/advisories/GHSA-mrmj-x24c-wwcv","reference_id":"GHSA-mrmj-x24c-wwcv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mrmj-x24c-wwcv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28692","GHSA-mrmj-x24c-wwcv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6h7x-3rue-kucp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20741?format=json","vulnerability_id":"VCID-6meg-yjby-a7gj","summary":"ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML\n### Summary\n\nA memory leak vulnerability exists in the `LoadOpenCLDeviceBenchmark()` function in `MagickCore/opencl.c`. When parsing a malformed OpenCL device profile XML file that contains `<device` elements without proper `/>` closing tags, the function fails to release allocated memory for string members (`platform_name`, `vendor_name`, `name`, `version`), leading to memory leaks that could result in resource exhaustion.\n\n**Affected Version**: ImageMagick 7.1.2-12 and possibly earlier versions\n\n---\n\n### Details\n\nThe vulnerability is located in `MagickCore/opencl.c`, function `LoadOpenCLDeviceBenchmark()` (lines 754-911).\n\n**Root Cause Analysis:**\n\n1. When a `<device` tag is encountered, a `MagickCLDeviceBenchmark` structure is allocated (line 807-812)\n2. String attributes (`platform`, `vendor`, `name`, `version`) are allocated via `ConstantString()` (lines 878, 885, 898, 900)\n3. These strings are **only freed** when a `/>` closing tag is encountered (lines 840-849)\n4. At function exit (lines 908-910), only the `device_benchmark` structure is freed, but **its member variables are not freed** if `/>` was never parsed\n\n**Vulnerable Code (lines 908-910):**\n\n```c\ntoken=(char *) RelinquishMagickMemory(token);\ndevice_benchmark=(MagickCLDeviceBenchmark *) RelinquishMagickMemory(\n  device_benchmark);  // BUG: members (platform_name, vendor_name, name, version) not freed!\n```\n\n**Correct cleanup (only executed when `/>` is found, lines 840-849):**\n\n```c\ndevice_benchmark->platform_name=(char *) RelinquishMagickMemory(device_benchmark->platform_name);\ndevice_benchmark->vendor_name=(char *) RelinquishMagickMemory(device_benchmark->vendor_name);\ndevice_benchmark->name=(char *) RelinquishMagickMemory(device_benchmark->name);\ndevice_benchmark->version=(char *) RelinquishMagickMemory(device_benchmark->version);\ndevice_benchmark=(MagickCLDeviceBenchmark *) RelinquishMagickMemory(device_benchmark);\n```\n\n---\n\n### PoC\n\n**Environment:**\n- OS: Ubuntu 22.04.5 LTS (Linux 6.8.0-87-generic x86_64)\n- Compiler: GCC 11.4.0\n- ImageMagick: 7.1.2-13 (commit `a52c1b402be08ef8ae193f28ac5b2e120f2fa26f`)\n\n**Step 1: Build ImageMagick with AddressSanitizer**\n\n```bash\ncd ImageMagick\n./configure \\\n    CFLAGS=\"-g -O0 -fsanitize=address -fno-omit-frame-pointer\" \\\n    CXXFLAGS=\"-g -O0 -fsanitize=address -fno-omit-frame-pointer\" \\\n    LDFLAGS=\"-fsanitize=address\" \\\n    --disable-openmp\nmake -j$(nproc)\n```\n\n**Step 2: Create malformed XML file**\n\n**Step 3: Place file in OpenCL cache directory**\n\n```bash\nmkdir -p ~/.cache/ImageMagick\ncp malformed_opencl_profile.xml ~/.cache/ImageMagick/ImagemagickOpenCLDeviceProfile.xml\n```\n\n**Step 4: Run ImageMagick with leak detection**\n\n```bash\nexport ASAN_OPTIONS=\"detect_leaks=1:symbolize=1\"\n./utilities/magick -size 100x100 xc:red output.png\n```\n\n**ASAN Output:**\n\n```\n=================================================================\n==2543490==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 96 byte(s) in 2 object(s) allocated from:\n    #0 ... in AcquireMagickMemory MagickCore/memory.c:536\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:807\n\nDirect leak of 16 byte(s) in 1 object(s) allocated from:\n    #0 ... in ConstantString MagickCore/string.c:692\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:878  ← name\n\nDirect leak of 14 byte(s) in 1 object(s) allocated from:\n    #0 ... in ConstantString MagickCore/string.c:692\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:885  ← platform_name\n\nDirect leak of 14 byte(s) in 1 object(s) allocated from:\n    #0 ... in ConstantString MagickCore/string.c:692\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:898  ← vendor_name\n\nDirect leak of 15 byte(s) in 1 object(s) allocated from:\n    #0 ... in ConstantString MagickCore/string.c:692\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:900  ← version\n\nSUMMARY: AddressSanitizer: 203 byte(s) leaked in 18 allocation(s).\n```\n\n---\n\n### Impact\n\n**Vulnerability Type:** CWE-401 (Missing Release of Memory after Effective Lifetime)\n\n**Severity:** Low\n\n**Who is impacted:**\n- Users who have OpenCL enabled in ImageMagick\n- Systems where an attacker can place or modify files in the OpenCL cache directory (`~/.cache/ImageMagick/`)\n- Long-running ImageMagick processes or services that repeatedly initialize OpenCL\n\n**Potential consequences:**\n- Memory exhaustion over time if the malformed configuration is repeatedly loaded\n- Denial of Service (DoS) in resource-constrained environments\n\n**Attack Vector:** Local - requires write access to the user's OpenCL cache directory","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv"},{"reference_url":"https://github.com/advisories/GHSA-qp59-x883-77qv","reference_id":"GHSA-qp59-x883-77qv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qp59-x883-77qv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61604?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bd1g-sfsp-37h7"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-z9t9-bxf9-hkfk"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.2"}],"aliases":["GHSA-qp59-x883-77qv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6meg-yjby-a7gj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20940?format=json","vulnerability_id":"VCID-6rma-wjdv-uqe9","summary":"mageMagick has a possible use-after-free write in its PDB decoder\nA use-after-free vulnerability exists in the PDB decoder that will use a stale pointer when a memory allocation fails and that could result in a crash or a single zero byte write.\n\n```\n==4033155==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589c1971b24 bp 0x7ffdcc7ae2d0 sp 0x7ffdcc7adb20 T0)\n```\n\n```\n==4034812==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f099e9f7800 at pc 0x5605d909ab20 bp 0x7ffe52045b50 sp 0x7ffe52045b40\nWRITE of size 1 at 0x7f099e9f7800 thread T0\n```","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/168ffe18def968f886c023146a478897866fd621","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/168ffe18def968f886c023146a478897866fd621"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4x-rwrx-xxj9","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4x-rwrx-xxj9"},{"reference_url":"https://github.com/advisories/GHSA-3j4x-rwrx-xxj9","reference_id":"GHSA-3j4x-rwrx-xxj9","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3j4x-rwrx-xxj9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["GHSA-3j4x-rwrx-xxj9"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6rma-wjdv-uqe9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20982?format=json","vulnerability_id":"VCID-6ztv-auh8-27gx","summary":"ImageMagick: Memory Leak in multiple coders that write raw pixel data\nA memory leak vulnerability exists in multiple coders that write raw pixel data where an object is not freed. \n\n```\nDirect leak of 160 byte(s) in 1 object(s) allocated from:\n```","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/fe0a49a58ac5b7a18ff2618b6207dcad71123e43","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/fe0a49a58ac5b7a18ff2618b6207dcad71123e43"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc"},{"reference_url":"https://github.com/advisories/GHSA-wfx3-6g53-9fgc","reference_id":"GHSA-wfx3-6g53-9fgc","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wfx3-6g53-9fgc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["GHSA-wfx3-6g53-9fgc"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6ztv-auh8-27gx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21827?format=json","vulnerability_id":"VCID-acsa-1uwk-fqee","summary":"ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression\n### Description\nA heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.\n\n### Expected Impact\nInformation disclosure leading to potential exposure of sensitive data from server memory.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24481","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03926","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03881","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03909","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03914","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03928","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03934","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03957","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04054","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04009","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04003","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03991","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0387","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0386","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14453","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24481"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24481","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24481"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/51c9d33f4770cdcfa1a029199375d570af801c97","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/51c9d33f4770cdcfa1a029199375d570af801c97"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:39:38Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481"},{"reference_url":"https://github.com/advisories/GHSA-96pc-27rx-pr36","reference_id":"GHSA-96pc-27rx-pr36","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-96pc-27rx-pr36"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-24481","GHSA-96pc-27rx-pr36"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-acsa-1uwk-fqee"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22276?format=json","vulnerability_id":"VCID-anyp-2jr7-73a1","summary":"ImageMagick has a possible heap Use After Free vulnerability in its meta coder\nA heap Use After Free vulnerability exists in the meta coder when an allocation fails and a single byte is written to a stale pointer.\n\n```\n==535852==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000088ff at pc 0x5581bacac14d bp 0x7ffdf667edf0 sp 0x7ffdf667ede0\nWRITE of size 1 at 0x5210000088ff thread T0\n```","references":[{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/f5049954f12c6fcf090a776767526d2a4708d58b","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/f5049954f12c6fcf090a776767526d2a4708d58b"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm"},{"reference_url":"https://github.com/advisories/GHSA-2gq3-ww97-wfjm","reference_id":"GHSA-2gq3-ww97-wfjm","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2gq3-ww97-wfjm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["GHSA-2gq3-ww97-wfjm"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-anyp-2jr7-73a1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24109?format=json","vulnerability_id":"VCID-b43n-3d1g-u3fe","summary":"ImageMagick's failure to limit MVG mutual causes Stack Overflow\nMagick fails to check for circular references between two MVGs, leading to a stack overflow.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68950.json","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68950.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68950","reference_id":"","reference_type":"","scores":[{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06645","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.0665","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06636","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06625","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06475","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06467","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06474","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06553","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06512","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06462","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06532","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06438","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06541","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06548","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68950"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68950","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68950"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:01Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426284","reference_id":"2426284","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426284"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68950","reference_id":"CVE-2025-68950","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68950"},{"reference_url":"https://github.com/advisories/GHSA-7rvh-xqp3-pr8j","reference_id":"GHSA-7rvh-xqp3-pr8j","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7rvh-xqp3-pr8j"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j","reference_id":"GHSA-7rvh-xqp3-pr8j","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:01Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67195?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bd1g-sfsp-37h7"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-z9t9-bxf9-hkfk"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.1"}],"aliases":["CVE-2025-68950","GHSA-7rvh-xqp3-pr8j"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b43n-3d1g-u3fe"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21980?format=json","vulnerability_id":"VCID-b5pd-kk97-gban","summary":"ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS\nMagick fails to check for multi-layer nested mvg conversions to svg, leading to DoS.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24484.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24484.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24484","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04489","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04468","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04498","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04515","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0453","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04541","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04477","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04524","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04716","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0469","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04656","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04614","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17539","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24484"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24484","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24484"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:41:00Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:41:00Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:41:00Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442085","reference_id":"2442085","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442085"},{"reference_url":"https://github.com/advisories/GHSA-wg3g-gvx5-2pmv","reference_id":"GHSA-wg3g-gvx5-2pmv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wg3g-gvx5-2pmv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-24484","GHSA-wg3g-gvx5-2pmv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b5pd-kk97-gban"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20995?format=json","vulnerability_id":"VCID-bd1g-sfsp-37h7","summary":"ImageMagick: Stack buffer overflow in FTXT reader via oversized integer field\n### Summary\nA stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash.\n\n```\n=================================================================\n==3537074==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffee4850ef0 at pc 0x5607c408fb33 bp 0x7ffee484fe50 sp 0x7ffee484fe40\nWRITE of size 1 at 0x7ffee4850ef0 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25967.json","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25967.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25967","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04961","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04955","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04916","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04879","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18055","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.1811","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17811","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17899","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.1796","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17976","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17931","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17882","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17825","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17835","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25967"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/9afe96cc325da1e4349fbd7418675af2f8708c10","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/9afe96cc325da1e4349fbd7418675af2f8708c10"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-72hf-fj62-w6j4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25967","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25967"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442126","reference_id":"2442126","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442126"},{"reference_url":"https://github.com/advisories/GHSA-72hf-fj62-w6j4","reference_id":"GHSA-72hf-fj62-w6j4","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-72hf-fj62-w6j4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25967","GHSA-72hf-fj62-w6j4"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bd1g-sfsp-37h7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22850?format=json","vulnerability_id":"VCID-bw4q-dt1r-y3e4","summary":"ImageMagick has heap-based buffer overflow in UHDR encoder\nA heap-based buffer overflow in the UHDR encoder can happen due to truncation of a value and it would allow an out of bounds write.\n\n```\n================================================================\n==2158399==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x521000039500 at pc 0x562a4a42f968 bp 0x7ffcca4ed6c0 sp 0x7ffcca4ed6b0\nWRITE of size 1 at 0x521000039500 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30931.json","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30931.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30931","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02791","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02787","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02779","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02811","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02764","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03928","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04071","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04026","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04019","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04009","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03889","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03878","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03945","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03899","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30931"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h95r-c8c7-mrwx","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:53:03Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h95r-c8c7-mrwx"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30931","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30931"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445900","reference_id":"2445900","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445900"},{"reference_url":"https://github.com/advisories/GHSA-h95r-c8c7-mrwx","reference_id":"GHSA-h95r-c8c7-mrwx","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h95r-c8c7-mrwx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-30931","GHSA-h95r-c8c7-mrwx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bw4q-dt1r-y3e4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21017?format=json","vulnerability_id":"VCID-cbqr-aybx-d3e6","summary":"ImageMagick has Use After Free in MSLStartElement in \"coders/msl.c\"\nA crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25983.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25983.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25983","reference_id":"","reference_type":"","scores":[{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08115","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08147","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08193","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08141","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08209","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08227","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08218","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08197","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.0818","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08076","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08062","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.0822","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.0819","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08151","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25983"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25983","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25983"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/257200cb21de23404dce5f8261871845d425dee5","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/257200cb21de23404dce5f8261871845d425dee5"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:04:31Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442113","reference_id":"2442113","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442113"},{"reference_url":"https://github.com/advisories/GHSA-fwqw-2x5x-w566","reference_id":"GHSA-fwqw-2x5x-w566","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fwqw-2x5x-w566"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25983","GHSA-fwqw-2x5x-w566"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cbqr-aybx-d3e6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22606?format=json","vulnerability_id":"VCID-cuhw-ew1g-s3h2","summary":"ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder\nA heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file.\n\n```\n=================================================================\n==1500633==ERROR: AddressSanitizer: heap-use-after-free on address 0x527000011550 at pc 0x5612583fa212 bp 0x7ffedb86d160 sp 0x7ffedb86d150\nREAD of size 8 at 0x527000011550 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28687.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28687.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28687","reference_id":"","reference_type":"","scores":[{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.16984","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.16896","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.17114","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.17042","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.17059","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18472","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18246","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18288","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18302","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18402","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18377","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18365","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.1852","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18421","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28687"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28687","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28687"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T16:01:50Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28687","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28687"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445897","reference_id":"2445897","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445897"},{"reference_url":"https://github.com/advisories/GHSA-fpvf-frm6-625q","reference_id":"GHSA-fpvf-frm6-625q","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fpvf-frm6-625q"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28687","GHSA-fpvf-frm6-625q"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cuhw-ew1g-s3h2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20981?format=json","vulnerability_id":"VCID-d8yf-8rff-3yhf","summary":"ImageMagick has a possible infinite loop in its JPEG encoder when using `jpeg:extent`\nA `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26283.json","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26283.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26283","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05183","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04976","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05003","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05024","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05057","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05072","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05051","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05033","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05016","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04956","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04966","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05114","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05139","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0518","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26283"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26283","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26283"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/c448c6920a985872072fc7be6034f678c087de9b","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/c448c6920a985872072fc7be6034f678c087de9b"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwr3-x37h-h84v","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-24T20:47:27Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwr3-x37h-h84v"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26283","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26283"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442140","reference_id":"2442140","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442140"},{"reference_url":"https://github.com/advisories/GHSA-gwr3-x37h-h84v","reference_id":"GHSA-gwr3-x37h-h84v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gwr3-x37h-h84v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-26283","GHSA-gwr3-x37h-h84v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-d8yf-8rff-3yhf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24995?format=json","vulnerability_id":"VCID-dabd-m3mf-3ker","summary":"ImageMagick has Heap Buffer Over-Read in BilateralBlurImage\nBilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the `-bilateral-blur` operation an out of bounds read can occur.\n\n```\n=================================================================\n==676172==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50a0000079c0 at pc 0x57b483c722f7 bp 0x7fffc0acd380 sp 0x7fffc0acd370\nREAD of size 4 at 0x50a0000079c0 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30935.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30935.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30935","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02421","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02416","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02417","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02441","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02407","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02954","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03084","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03039","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03051","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03052","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02931","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02921","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02977","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02945","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30935"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cqw9-w2m7-r2m2","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:50:49Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cqw9-w2m7-r2m2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30935","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30935"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445899","reference_id":"2445899","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445899"},{"reference_url":"https://github.com/advisories/GHSA-cqw9-w2m7-r2m2","reference_id":"GHSA-cqw9-w2m7-r2m2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cqw9-w2m7-r2m2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-30935","GHSA-cqw9-w2m7-r2m2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dabd-m3mf-3ker"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22188?format=json","vulnerability_id":"VCID-dtza-65ku-aber","summary":"ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)\nIn `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash.\n\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1414421==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x56260222912f bp 0x7ffec0a193b0 sp 0x7ffec0a19360 T0)\n    #0 0x56260222912f  (/data/ylwang/LargeScan/targets/ImageMagick/utilities/magick+0x235f12f)\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25795.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25795.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25795","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05197","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05185","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05199","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05216","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05248","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05177","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05229","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05363","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05364","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05323","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05285","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05133","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0513","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19112","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25795"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25795","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25795"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/55c344f4b514213642da41194bab57b4476fb9f5","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/55c344f4b514213642da41194bab57b4476fb9f5"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:07:57Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442099","reference_id":"2442099","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442099"},{"reference_url":"https://github.com/advisories/GHSA-p33r-fqw2-rqmm","reference_id":"GHSA-p33r-fqw2-rqmm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p33r-fqw2-rqmm"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25795","GHSA-p33r-fqw2-rqmm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dtza-65ku-aber"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21243?format=json","vulnerability_id":"VCID-emmr-15qp-vfah","summary":"ImageMagick has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer\nThe UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash.\n\n```\nREAD of size 1 at 0x55a8823a776e thread T0\n    #0 0x55a880d01e85 in WriteUILImage coders/uil.c:355\n```\n\n```\nREAD of size 1 at 0x55fa1c04c66e thread T0\n    #0 0x55fa1a9ee415 in WriteXPMImage coders/xpm.c:1135\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25898.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25898.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25898","reference_id":"","reference_type":"","scores":[{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05778","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05771","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05734","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.057","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05535","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05526","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05579","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05586","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05596","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05624","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.056","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05563","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05562","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18459","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25898"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25898","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25898"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/c9c87dbaba56bf82aebd3392e11f0ffd93709b12","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/c9c87dbaba56bf82aebd3392e11f0ffd93709b12"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:26:22Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442102","reference_id":"2442102","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442102"},{"reference_url":"https://github.com/advisories/GHSA-vpxv-r9pg-7gpr","reference_id":"GHSA-vpxv-r9pg-7gpr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vpxv-r9pg-7gpr"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25898","GHSA-vpxv-r9pg-7gpr"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-emmr-15qp-vfah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21918?format=json","vulnerability_id":"VCID-f1zu-xb4j-8qhp","summary":"ImageMagick has a heap buffer over-read in its MAP image decoder\nA heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding.\n\n```\n=================================================================\n==4070926==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000002b31 at pc 0x56517afbd910 bp 0x7ffc59e90000 sp 0x7ffc59e8fff0\nREAD of size 1 at 0x502000002b31 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25987.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25987.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25987","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03433","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03334","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03346","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03354","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03359","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0338","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03339","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0331","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03289","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03265","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03275","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03398","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03385","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03388","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25987"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25987","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25987"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/bbae0215e1b76830509fd20e6d37c0dd7e3e4c3a","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/bbae0215e1b76830509fd20e6d37c0dd7e3e4c3a"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:07:26Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442115","reference_id":"2442115","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442115"},{"reference_url":"https://github.com/advisories/GHSA-42p5-62qq-mmh7","reference_id":"GHSA-42p5-62qq-mmh7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-42p5-62qq-mmh7"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25987","GHSA-42p5-62qq-mmh7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-f1zu-xb4j-8qhp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21438?format=json","vulnerability_id":"VCID-fnck-7mvx-hqc9","summary":"ImageMagick has a heap Buffer Over-read  in its DJVU image format handler\nA heap Buffer Over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27799.json","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27799.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27799","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03452","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03408","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03402","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03416","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03299","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03288","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03365","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03312","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03353","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03335","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03363","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03406","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03385","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0338","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27799"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27799","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27799"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T17:03:55Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/e87695b3227978ad70b967b8d054baaf8ac2cced","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T17:03:55Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/e87695b3227978ad70b967b8d054baaf8ac2cced"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r99p-5442-q2x2","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T17:03:55Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r99p-5442-q2x2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27799","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27799"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442879","reference_id":"2442879","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442879"},{"reference_url":"https://github.com/advisories/GHSA-r99p-5442-q2x2","reference_id":"GHSA-r99p-5442-q2x2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r99p-5442-q2x2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-27799","GHSA-r99p-5442-q2x2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fnck-7mvx-hqc9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24450?format=json","vulnerability_id":"VCID-g41y-dv8u-3yf1","summary":"ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage\nA crafted image could cause an out of bounds heap write inside the WaveletDenoiseImage method. When processing a crafted image with the -wavelet-denoise operation an out of bounds write can occur.\n\n```\n=================================================================\n==661320==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x503000002754 at pc 0x5ff45f82c92a bp 0x7fffb732b400 sp 0x7fffb732b3f0\nWRITE of size 4 at 0x503000002754 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30936.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30936.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30936","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04412","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04378","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04368","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04429","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04346","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05114","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05277","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05273","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05231","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.052","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05052","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05047","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0513","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05099","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30936"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30936","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30936"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5ggv-92r5-cp4p","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:48:08Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5ggv-92r5-cp4p"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30936","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30936"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445880","reference_id":"2445880","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445880"},{"reference_url":"https://github.com/advisories/GHSA-5ggv-92r5-cp4p","reference_id":"GHSA-5ggv-92r5-cp4p","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5ggv-92r5-cp4p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-30936","GHSA-5ggv-92r5-cp4p"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g41y-dv8u-3yf1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21044?format=json","vulnerability_id":"VCID-gdg8-aejn-83c4","summary":"ImageMagick: Policy bypass through path traversal allows reading restricted content despite secured policy\nImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied.\n\nActions to prevent reading from files have been taken. But it make sure writing is also not possible the following should be added to your policy:\n\n```\n<policy domain=\"path\" rights=\"none\" pattern=\"*../*\"/>\n```\n\nAnd this will also be included in the project's more secure policies by default.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25965.json","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25965.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25965","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04578","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04535","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04515","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04488","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04357","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04348","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04382","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04398","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04413","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04419","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04402","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04359","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04369","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14614","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25965"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25965","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25965"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:28:41Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442118","reference_id":"2442118","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442118"},{"reference_url":"https://github.com/advisories/GHSA-8jvj-p28h-9gm7","reference_id":"GHSA-8jvj-p28h-9gm7","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8jvj-p28h-9gm7"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:5573","reference_id":"RHSA-2026:5573","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:5573"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25965","GHSA-8jvj-p28h-9gm7"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gdg8-aejn-83c4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20601?format=json","vulnerability_id":"VCID-h221-qd8d-tqa5","summary":"ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load\n## Summary\n\nNULL pointer dereference in MSL (Magick Scripting Language) parser when processing `<comment>` tag before any image is loaded.\n\n## Version\n\n- ImageMagick 7.x (tested on current main branch)\n- Commit: HEAD\n\n## Steps to Reproduce\n\n### Method 1: Using ImageMagick directly\n\n```bash\nmagick MSL:poc.msl out.png\n```\n\n### Method 2: Using OSS-Fuzz reproduce\n\n```bash\npython3 infra/helper.py build_fuzzers imagemagick\npython3 infra/helper.py reproduce imagemagick msl_fuzzer poc.msl\n```\n\nOr run the fuzzer directly:\n```bash\n./msl_fuzzer poc.msl\n```\n\n## Expected Behavior\n\nImageMagick should handle the malformed MSL gracefully and return an error message.\n\n## Actual Behavior\n\n```\nconvert: MagickCore/property.c:297: MagickBooleanType DeleteImageProperty(Image *, const char *): Assertion `image != (Image *) NULL' failed.\nAborted\n```\n\n## Root Cause Analysis\n\nIn `coders/msl.c:7091`, `MSLEndElement()` calls `DeleteImageProperty()` on `msl_info->image[n]` when handling the `</comment>` end tag without checking if the image is NULL:\n\n```c\nif (LocaleCompare((const char *) tag,\"comment\") == 0 )\n  {\n    (void) DeleteImageProperty(msl_info->image[n],\"comment\");  // No NULL check\n    ...\n  }\n```\n\nWhen `<comment>` appears before any `<read>` operation, `msl_info->image[n]` is NULL, causing the assertion failure in `DeleteImageProperty()` at `property.c:297`.\n\n## Impact\n\n- **DoS**: Crash via assertion failure (debug builds) or NULL pointer dereference (release builds)\n- **Affected**: Any application using ImageMagick to process user-supplied MSL files\n\n## Fuzzer\n\nThis issue was discovered using a custom MSL fuzzer:\n\n```cpp\n#include <cstdint>\n#include <Magick++/Blob.h>\n#include <Magick++/Image.h>\n#include \"utils.cc\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)\n{\n  if (IsInvalidSize(Size))\n    return(0);\n  try\n  {\n    const Magick::Blob blob(Data, Size);\n    Magick::Image image;\n    image.magick(\"MSL\");\n    image.fileName(\"MSL:\");\n    image.read(blob);\n  }\n  catch (Magick::Exception)\n  {\n  }\n  return(0);\n}\n```\n\nThis issue was found by Team FuzzingBrain @ Texas A&M University","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23952.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23952.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23952","reference_id":"","reference_type":"","scores":[{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05768","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05762","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05726","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05576","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05553","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.0559","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05615","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05586","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.0569","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05517","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05525","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05569","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23952"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23952","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23952"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-22T21:43:24Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-22T21:43:24Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126077","reference_id":"1126077","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126077"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431905","reference_id":"2431905","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431905"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","reference_id":"CVE-2026-23952","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952"},{"reference_url":"https://github.com/advisories/GHSA-5vx3-wx4q-6cj8","reference_id":"GHSA-5vx3-wx4q-6cj8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5vx3-wx4q-6cj8"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61604?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bd1g-sfsp-37h7"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-z9t9-bxf9-hkfk"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.2"}],"aliases":["CVE-2026-23952","GHSA-5vx3-wx4q-6cj8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-h221-qd8d-tqa5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24565?format=json","vulnerability_id":"VCID-jc5m-7rvc-2qg6","summary":"ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash\nThe NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32636.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32636.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-32636","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04324","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04277","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04268","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04297","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0426","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04318","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04332","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04281","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04293","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0434","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05174","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0517","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05128","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05103","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-32636"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32636","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32636"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-19T14:54:31Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-19T14:54:31Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-19T14:54:31Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448862","reference_id":"2448862","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448862"},{"reference_url":"https://github.com/advisories/GHSA-gc62-2v5p-qpmp","reference_id":"GHSA-gc62-2v5p-qpmp","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gc62-2v5p-qpmp"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67779?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.11.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.11.0"}],"aliases":["CVE-2026-32636","GHSA-gc62-2v5p-qpmp"],"risk_score":3.4,"exploitability":"0.5","weighted_severity":"6.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jc5m-7rvc-2qg6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21320?format=json","vulnerability_id":"VCID-jcjk-s89c-mbbm","summary":"ImageMagick: Invalid MSL <map> can result in a use after free\nThe MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26983.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26983.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26983","reference_id":"","reference_type":"","scores":[{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03824","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03701","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03712","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03726","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03729","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03752","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.0371","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03687","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03661","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03638","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03649","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03771","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03774","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03777","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26983"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26983","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26983"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/7cfae4da24a995fb05386d77364ff404a7cca7bc","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/7cfae4da24a995fb05386d77364ff404a7cca7bc"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:09:37Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442134","reference_id":"2442134","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442134"},{"reference_url":"https://github.com/advisories/GHSA-w8mw-frc6-r7m8","reference_id":"GHSA-w8mw-frc6-r7m8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-w8mw-frc6-r7m8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-26983","GHSA-w8mw-frc6-r7m8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jcjk-s89c-mbbm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20803?format=json","vulnerability_id":"VCID-jvq6-xjbu-fkb9","summary":"ImageMagick: Infinite loop vulnerability when parsing a PCD file\nWhen a PCD file does not contain a valid marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24485.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24485.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24485","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.049","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04888","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04849","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04666","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04815","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04674","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04682","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04696","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0473","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04742","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04733","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04715","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04698","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17962","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24485"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24485","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24485"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:48:11Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:48:11Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:48:11Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442091","reference_id":"2442091","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442091"},{"reference_url":"https://github.com/advisories/GHSA-pqgj-2p96-rx85","reference_id":"GHSA-pqgj-2p96-rx85","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pqgj-2p96-rx85"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-24485","GHSA-pqgj-2p96-rx85"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jvq6-xjbu-fkb9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21172?format=json","vulnerability_id":"VCID-kdw5-8y5z-zya5","summary":"ImageMagick: Possible memory leak in ASHLAR encoder\nA memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed.\n\n```\n==880062== Memcheck, a memory error detector\n==880062== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.\n==880062== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info\n==880062== \n==880062== \n==880062== HEAP SUMMARY:\n==880062==     in use at exit: 386,826 bytes in 696 blocks\n==880062==   total heap usage: 30,523 allocs, 29,827 frees, 21,803,756 bytes allocated\n==880062== \n==880062== LEAK SUMMARY:\n==880062==    definitely lost: 3,408 bytes in 3 blocks\n==880062==    indirectly lost: 88,885 bytes in 30 blocks\n==880062==      possibly lost: 140,944 bytes in 383 blocks\n==880062==    still reachable: 151,573 bytes in 259 blocks\n==880062==         suppressed: 0 bytes in 0 blocks\n==880062== Reachable blocks (those to which a pointer was found) are not shown.\n==880062== To see them, rerun with: --leak-check=full --show-leak-kinds=all\n==880062== \n==880062== For lists of detected and suppressed errors, rerun with: -s\n==880062== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25637.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25637.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25637","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04716","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0469","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04656","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04614","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17539","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17584","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17366","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17458","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17517","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.1753","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17481","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17429","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17372","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.1738","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25637"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/30ce0e8efbd72fd6b50ed3a10ae22f57c8901137","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/30ce0e8efbd72fd6b50ed3a10ae22f57c8901137"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm37-qx7w-p258","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm37-qx7w-p258"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25637","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25637"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442114","reference_id":"2442114","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442114"},{"reference_url":"https://github.com/advisories/GHSA-gm37-qx7w-p258","reference_id":"GHSA-gm37-qx7w-p258","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gm37-qx7w-p258"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25637","GHSA-gm37-qx7w-p258"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kdw5-8y5z-zya5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21822?format=json","vulnerability_id":"VCID-kefv-kpkk-wudf","summary":"ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash\nA logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service.\n\n```\ncoders/yuv.c:210:47: runtime error: division by zero\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3543373==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x55deeb4d723c bp 0x7fffc28d34d0 sp 0x7fffc28d3320 T0)\n    #0 0x55deeb4d723c in ReadYUVImage coders/yuv.c:210\n    #1 0x55deeb751dff in ReadImage MagickCore/constitute.c:743\n    #2 0x55deeb756374 in ReadImages MagickCore/constitute.c:1082\n    #3 0x55deec682375 in CLINoImageOperator MagickWand/operation.c:4959\n    #4 0x55deec6887ed in CLIOption MagickWand/operation.c:5473\n    #5 0x55deec32843b in ProcessCommandOptions MagickWand/magick-cli.c:653\n    #6 0x55deec32b99b in MagickImageCommand MagickWand/magick-cli.c:1392\n    #7 0x55deec324d58 in MagickCommandGenesis MagickWand/magick-cli.c:177\n    #8 0x55deead82519 in MagickMain utilities/magick.c:162\n    #9 0x55deead828be in main utilities/magick.c:193\n    #10 0x7fb90807fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #11 0x7fb90807fe3f in __libc_start_main_impl ../csu/libc-start.c:392\n    #12 0x55deead81974 in _start (/data/ylwang/LargeScan/targets/ImageMagick/utilities/magick+0x22fb974)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: UNKNOWN SIGNAL coders/yuv.c:210 in ReadYUVImage\n==3543373==ABORTING\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25799.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25799.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25799","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05342","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05337","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05294","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05259","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05106","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05102","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05159","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05172","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05189","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05219","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05202","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05147","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05168","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.19061","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25799"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25799","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25799"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/49000e7298fbfdd759ac2c46f740f40c2e9b7452","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/49000e7298fbfdd759ac2c46f740f40c2e9b7452"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:22:05Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442120","reference_id":"2442120","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442120"},{"reference_url":"https://github.com/advisories/GHSA-543g-8grm-9cw6","reference_id":"GHSA-543g-8grm-9cw6","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-543g-8grm-9cw6"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25799","GHSA-543g-8grm-9cw6"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kefv-kpkk-wudf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22099?format=json","vulnerability_id":"VCID-mntx-6yku-3qcx","summary":"ImageMagick: SVG-to-MVG Command Injection via coders/svg.c\nAn attacker can inject arbitrary MVG (Magick Vector Graphics) drawing commands in an SVG file that is read by the internal SVG decoder of ImageMagick. The injected MVG commands execute during rendering.","references":[{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaa","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaa"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aa","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aa"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56"},{"reference_url":"https://github.com/advisories/GHSA-xpg8-7m6m-jf56","reference_id":"GHSA-xpg8-7m6m-jf56","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xpg8-7m6m-jf56"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["GHSA-xpg8-7m6m-jf56"],"risk_score":1.4,"exploitability":"0.5","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mntx-6yku-3qcx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24705?format=json","vulnerability_id":"VCID-n47w-r932-abey","summary":"ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder\nAn extremely large image profile could result in a heap overflow when encoding a PNG image.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30883.json","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30883.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30883","reference_id":"","reference_type":"","scores":[{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00642","published_at":"2026-04-11T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00446","published_at":"2026-04-04T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00439","published_at":"2026-04-07T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00435","published_at":"2026-04-08T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00437","published_at":"2026-04-09T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00637","published_at":"2026-04-12T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00679","published_at":"2026-04-29T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00677","published_at":"2026-04-26T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00676","published_at":"2026-04-24T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00636","published_at":"2026-04-18T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00631","published_at":"2026-04-16T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00447","published_at":"2026-04-02T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00638","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30883"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30883","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30883"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qmw5-2p58-xvrc","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:53:57Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qmw5-2p58-xvrc"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30883","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30883"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445878","reference_id":"2445878","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445878"},{"reference_url":"https://github.com/advisories/GHSA-qmw5-2p58-xvrc","reference_id":"GHSA-qmw5-2p58-xvrc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qmw5-2p58-xvrc"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-30883","GHSA-qmw5-2p58-xvrc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n47w-r932-abey"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21884?format=json","vulnerability_id":"VCID-p5aw-n691-nkff","summary":"ImageMagick: MSL image stack index may fail to refresh, leading to leaked images\nSometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks.\n\n```\n==841485==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 13512 byte(s) in 1 object(s) allocated from:\n    #0 0x7ff330759887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25988.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25988.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25988","reference_id":"","reference_type":"","scores":[{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06725","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06733","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06724","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06726","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06568","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06577","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06647","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06656","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06663","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06671","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06628","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06578","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06558","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06594","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25988"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25988","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25988"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/4354fc1d554ec2e6314aed13536efa7bde9593d2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/4354fc1d554ec2e6314aed13536efa7bde9593d2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:08:10Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442101","reference_id":"2442101","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442101"},{"reference_url":"https://github.com/advisories/GHSA-782x-jh29-9mf7","reference_id":"GHSA-782x-jh29-9mf7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-782x-jh29-9mf7"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25988","GHSA-782x-jh29-9mf7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p5aw-n691-nkff"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22389?format=json","vulnerability_id":"VCID-pcme-bwan-3bcf","summary":"ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image\nA NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in Denial of Service.\n\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3704942==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x7f9d141239e0 bp 0x7ffd4c5711e0 sp 0x7ffd4c571148 T0)\n    #0 0x7f9d141239e0  (/lib/x86_64-linux-gnu/libc.so.6+0xc49e0)\n    #1 0x558a25e4f08d in ClonePixelCacheRepository._omp_fn.0 MagickCore/cache.c:784\n    #2 0x7f9d14c06a15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)\n    #3 0x558a25e43151 in ClonePixelCacheRepository MagickCore/cache.c:753\n    #4 0x558a25e49a96 in OpenPixelCache MagickCore/cache.c:3849\n    #5 0x558a25e45117 in GetImagePixelCache MagickCore/cache.c:1829\n    #6 0x558a25e4dde3 in SyncImagePixelCache MagickCore/cache.c:5647\n    #7 0x558a256ba57d in SetImageExtent MagickCore/image.c:2713\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25798.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25798.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25798","reference_id":"","reference_type":"","scores":[{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19405","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19433","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19491","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19538","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19535","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19683","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19483","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19264","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19304","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19314","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19416","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19401","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19393","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35968","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25798"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25798","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25798"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/e046417675d5c26e5f48816851a406c121c77469","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/e046417675d5c26e5f48816851a406c121c77469"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/issues/8567","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/issues/8567"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:20:58Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442119","reference_id":"2442119","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442119"},{"reference_url":"https://github.com/advisories/GHSA-p863-5fgm-rgq4","reference_id":"GHSA-p863-5fgm-rgq4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p863-5fgm-rgq4"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25798","GHSA-p863-5fgm-rgq4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pcme-bwan-3bcf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24199?format=json","vulnerability_id":"VCID-r3vw-ncns-cqgb","summary":"ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder\nAn overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-31853.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-31853.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31853","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02624","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02629","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02621","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02606","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02649","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02625","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03205","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03371","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03326","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03335","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03215","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03252","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0323","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31853"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31853","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31853"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56jp-jfqg-f8f4","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-11T17:41:49Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56jp-jfqg-f8f4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31853","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31853"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446690","reference_id":"2446690","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446690"},{"reference_url":"https://github.com/advisories/GHSA-56jp-jfqg-f8f4","reference_id":"GHSA-56jp-jfqg-f8f4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-56jp-jfqg-f8f4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-31853","GHSA-56jp-jfqg-f8f4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r3vw-ncns-cqgb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/23142?format=json","vulnerability_id":"VCID-rbdg-vz8x-ykah","summary":"ImageMagick has heap use-after-free in the MSL encoder\nA heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. \n\n```\nSUMMARY: AddressSanitizer: heap-use-after-free MagickCore/image.c:1195 in DestroyImage\nShadow bytes around the buggy address:\n  0x0a4e80007450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0a4e80007460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0a4e80007470: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0a4e80007480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0a4e80007490: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0a4e800074a0: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd\n  0x0a4e800074b0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa\n  0x0a4e800074c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0a4e800074d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0a4e800074e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0a4e800074f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28688.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28688.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28688","reference_id":"","reference_type":"","scores":[{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12738","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12659","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12854","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12789","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12806","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.14015","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13834","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13902","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13897","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13825","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13832","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13928","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13978","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28688"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28688","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28688"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T16:02:13Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28688","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28688"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445877","reference_id":"2445877","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445877"},{"reference_url":"https://github.com/advisories/GHSA-xxw5-m53x-j38c","reference_id":"GHSA-xxw5-m53x-j38c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xxw5-m53x-j38c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28688","GHSA-xxw5-m53x-j38c"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rbdg-vz8x-ykah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/23631?format=json","vulnerability_id":"VCID-rj9n-ra1t-77dy","summary":"ImageMagick has stack buffer overflow in MagnifyImage\nMagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30929.json","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30929.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30929","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02791","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02787","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02779","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02811","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02764","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03928","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04071","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04026","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04019","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04009","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03889","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03878","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03945","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03899","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30929"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rqq8-jh93-f4vg","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T14:52:35Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rqq8-jh93-f4vg"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30929","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30929"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445896","reference_id":"2445896","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445896"},{"reference_url":"https://github.com/advisories/GHSA-rqq8-jh93-f4vg","reference_id":"GHSA-rqq8-jh93-f4vg","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rqq8-jh93-f4vg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-30929","GHSA-rqq8-jh93-f4vg"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rj9n-ra1t-77dy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24389?format=json","vulnerability_id":"VCID-rjkf-pdny-2fhn","summary":"ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays\nA stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28494.json","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28494.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28494","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02629","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02625","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02649","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02621","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02606","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03279","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03371","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03326","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03335","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03215","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03205","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0323","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03252","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28494"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28494","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28494"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T14:40:59Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28494","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28494"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445901","reference_id":"2445901","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445901"},{"reference_url":"https://github.com/advisories/GHSA-932h-jw47-73jm","reference_id":"GHSA-932h-jw47-73jm","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-932h-jw47-73jm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28494","GHSA-932h-jw47-73jm"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rjkf-pdny-2fhn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21733?format=json","vulnerability_id":"VCID-sd54-b8z1-2fg7","summary":"ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder\nA crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25989.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25989.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25989","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0531","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05082","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05112","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05133","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05167","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05183","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05154","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05137","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05124","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05071","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05076","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05228","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05261","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05305","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25989"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25989","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25989"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:08:53Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442136","reference_id":"2442136","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442136"},{"reference_url":"https://github.com/advisories/GHSA-7355-pwx2-pm84","reference_id":"GHSA-7355-pwx2-pm84","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7355-pwx2-pm84"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25989","GHSA-7355-pwx2-pm84"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sd54-b8z1-2fg7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20798?format=json","vulnerability_id":"VCID-sd7w-6qv5-73ge","summary":"ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds\nAn integer overflow in the PSB (PSD v2) RLE decoding path causes a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing crafted PSB files.\n\n```\n=================================================================\n==3298==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf512eb00 at pc 0xf76760b5 bp 0xffc1dfb8 sp 0xffc1dfa8\nREAD of size 8 at 0xf512eb00 thread T0\n    #0 0xf76760b4 in ReadPSDChannelRLE coders/psd.c:1141\n```","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435c","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435c"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25984","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25984"},{"reference_url":"https://github.com/advisories/GHSA-273h-m46v-96q4","reference_id":"GHSA-273h-m46v-96q4","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-273h-m46v-96q4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25984","GHSA-273h-m46v-96q4"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sd7w-6qv5-73ge"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24164?format=json","vulnerability_id":"VCID-sdc2-fcap-abaz","summary":"ImageMagick has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)\nA heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image).","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25982.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25982.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25982","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04156","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04084","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04116","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0413","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04162","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04176","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04142","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04278","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04242","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04223","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04211","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04092","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16707","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25982"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25982","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25982"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:03:44Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442124","reference_id":"2442124","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442124"},{"reference_url":"https://github.com/advisories/GHSA-pmq6-8289-hx3v","reference_id":"GHSA-pmq6-8289-hx3v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pmq6-8289-hx3v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25982","GHSA-pmq6-8289-hx3v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sdc2-fcap-abaz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/23701?format=json","vulnerability_id":"VCID-spch-fffg-4yc5","summary":"Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family\n## Withdrawn Advisory\nThis advisory has been withdrawn because it does not affect the ImageMagick project's NuGet packages.\n\n### Original Description\nWe believe that we have discovered a potential security vulnerability in ImageMagick’s Magick++ layer that manifests when `Options::fontFamily` is invoked with an empty string.\n\n**Vulnerability Details**\n- Clearing a font family calls `RelinquishMagickMemory` on `_drawInfo->font`, freeing the font string but leaving `_drawInfo->font` pointing to freed memory while `_drawInfo->family` is set to that (now-invalid) pointer. Any later cleanup or reuse of `_drawInfo->font` re-frees or dereferences dangling memory.\n- `DestroyDrawInfo` and other setters (`Options::font`, `Image::font`) assume `_drawInfo->font` remains valid, so destruction or subsequent updates trigger crashes or heap corruption.\n\n```cpp\nif (family_.length() == 0)\n  {\n    _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);\n    DestroyString(RemoveImageOption(imageInfo(),\"family\"));\n  }\n```\n\n- **CWE-416 (Use After Free):** `_drawInfo->font` is left dangling yet still reachable through the Options object.\n- **CWE-415 (Double Free):** DrawInfo teardown frees `_drawInfo->font` again, provoking allocator aborts.\n\n**Affected Versions**\n- Introduced by commit `6409f34d637a34a1c643632aa849371ec8b3b5a8` (“Added fontFamily to the Image class of Magick++”, 2015-08-01, blame line 313).\n- Present in all releases that include that commit, at least ImageMagick 7.0.1-0 and later (likely late 6.9 builds with Magick++ font family support as well). Older releases without `fontFamily` are unaffected.\n\n**Command Line Triggerability**\nThis vulnerability cannot be triggered from the command line interface. The bug is specific to the Magick++ C++ API, specifically the `Options::fontFamily()` method. The command-line utilities (such as `convert`, `magick`, etc.) do not expose this particular code path, as they operate through different internal mechanisms that do not directly call `Options::fontFamily()` with an empty string in a way that would trigger the use-after-free condition.\n\n**Proposed Fix**\n```diff\ndiff --git a/Magick++/lib/Options.cpp b/Magick++/lib/Options.cpp\n@@ void Magick::Options::fontFamily(const std::string &family_)\n-      _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);\n+      _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->family);\n```\nThis frees only the actual family string, leaving `_drawInfo->font` untouched. Optionally nulling `_drawInfo->font` when clearing `font()` itself maintains allocator hygiene.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65955.json","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65955.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-65955","reference_id":"","reference_type":"","scores":[{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05753","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07863","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07936","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07781","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07797","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07883","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07896","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07912","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07925","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07901","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07844","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.0789","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07832","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-65955"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65955","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65955"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/6409f34d637a34a1c643632aa849371ec8b3b5a8","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/6409f34d637a34a1c643632aa849371ec8b3b5a8"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/6f81eb15f822ad86e8255be75efad6f9762c32f8","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/6f81eb15f822ad86e8255be75efad6f9762c32f8"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122827","reference_id":"1122827","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122827"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418549","reference_id":"2418549","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418549"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65955","reference_id":"CVE-2025-65955","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65955"},{"reference_url":"https://github.com/advisories/GHSA-q3hc-j9x5-mp9m","reference_id":"GHSA-q3hc-j9x5-mp9m","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q3hc-j9x5-mp9m"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q3hc-j9x5-mp9m","reference_id":"GHSA-q3hc-j9x5-mp9m","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q3hc-j9x5-mp9m"}],"fixed_packages":[],"aliases":["CVE-2025-65955","GHSA-q3hc-j9x5-mp9m"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-spch-fffg-4yc5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24208?format=json","vulnerability_id":"VCID-sw7g-hxxr-n3e1","summary":"ImageMagick has a Path Policy TOCTOU symlink race bypass\n`domain=\"path\"` authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28689.json","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28689.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28689","reference_id":"","reference_type":"","scores":[{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00712","published_at":"2026-04-09T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00722","published_at":"2026-04-08T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00723","published_at":"2026-04-07T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00718","published_at":"2026-04-04T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00721","published_at":"2026-04-02T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00953","published_at":"2026-04-26T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00896","published_at":"2026-04-18T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.0089","published_at":"2026-04-12T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00892","published_at":"2026-04-13T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00889","published_at":"2026-04-16T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00945","published_at":"2026-04-29T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00949","published_at":"2026-04-24T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28689"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28689","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28689"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-493f-jh8w-qhx3","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T15:56:31Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-493f-jh8w-qhx3"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28689","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28689"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445891","reference_id":"2445891","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445891"},{"reference_url":"https://github.com/advisories/GHSA-493f-jh8w-qhx3","reference_id":"GHSA-493f-jh8w-qhx3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-493f-jh8w-qhx3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28689","GHSA-493f-jh8w-qhx3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sw7g-hxxr-n3e1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/25007?format=json","vulnerability_id":"VCID-tv15-dcnu-pbbn","summary":"ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.\nThe pcd coder lacks proper boundary checking when processing Huffman-coded data. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read.\n\n```\n==3900053==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000003c6c at pc 0x55601b9cc552 bp 0x7ffd904b1f70 sp 0x7ffd904b1f60\nREAD of size 1 at 0x502000003c6c thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26284.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26284.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26284","reference_id":"","reference_type":"","scores":[{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05884","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05853","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05891","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05923","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05901","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05892","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06084","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.0608","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06044","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06013","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.0586","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05823","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05849","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05858","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26284"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26284","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26284"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-24T20:46:33Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442137","reference_id":"2442137","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442137"},{"reference_url":"https://github.com/advisories/GHSA-wrhr-rf8j-r842","reference_id":"GHSA-wrhr-rf8j-r842","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wrhr-rf8j-r842"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-26284","GHSA-wrhr-rf8j-r842"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tv15-dcnu-pbbn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24918?format=json","vulnerability_id":"VCID-utfe-h3b7-jqcj","summary":"ImageMagick: MSL - Stack overflow in ProcessMSLScript\n### Summary\nMagick fails to check for circular references between two MSLs, leading to a stack overflow.\n\n### Details\nAfter reading a.msl using magick, the following is displayed:\n\n`MSLStartElement` -> `ReadImage` -> `ReadMSLImage` -> `ProcessMSLScript` -> `xmlParseChunk` -> `xmlParseTryOrFinish` -> `MSLStartElement`\n\n```bash\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==114345==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x72509fc7d804 bp 0x7ffd6598b390 sp 0x7ffd6598ab20 T0)\n    #0 0x72509fc7d804 in strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:388\n[...]\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25971.json","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25971.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25971","reference_id":"","reference_type":"","scores":[{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.12904","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13007","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13088","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13138","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13107","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13068","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13017","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.12919","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.12922","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.1302","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13041","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13009","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13153","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13209","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25971"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25971","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25971"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25971","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25971"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442117","reference_id":"2442117","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442117"},{"reference_url":"https://github.com/advisories/GHSA-8mpr-6xr2-chhc","reference_id":"GHSA-8mpr-6xr2-chhc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8mpr-6xr2-chhc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25971","GHSA-8mpr-6xr2-chhc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-utfe-h3b7-jqcj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21084?format=json","vulnerability_id":"VCID-uvpj-a8v5-ebgz","summary":"Image Magick has a Memory Leak in coders/ashlar.c\nMemory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure.  However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak.\n\n```\n```bash\n==78968== Memcheck, a memory error detector\n==78968== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.\n==78968== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info\n==78968== \n==78968== HEAP SUMMARY:\n==78968==     in use at exit: 17,232 bytes in 4 blocks\n==78968==   total heap usage: 4,781 allocs, 4,777 frees, 785,472 bytes allocated\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25969.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25969.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25969","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04961","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04955","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04916","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04879","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18055","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.1811","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17811","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17899","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.1796","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17976","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17931","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17882","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17825","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17835","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25969"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/a253d1b124ebdcc2832daac6f9a35c362635b40e","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/a253d1b124ebdcc2832daac6f9a35c362635b40e"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xgm3-v4r9-wfgm","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xgm3-v4r9-wfgm"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25969","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25969"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442116","reference_id":"2442116","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442116"},{"reference_url":"https://github.com/advisories/GHSA-xgm3-v4r9-wfgm","reference_id":"GHSA-xgm3-v4r9-wfgm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xgm3-v4r9-wfgm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25969","GHSA-xgm3-v4r9-wfgm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uvpj-a8v5-ebgz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20141?format=json","vulnerability_id":"VCID-vaks-d4k5-zue7","summary":"ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript\n## Summary\n\nStack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format.\n\n## Version\n\n- ImageMagick 7.x (tested on current main branch)\n- Commit: HEAD\n- Requires: libxml2 support (for MSL parsing)\n\n## Steps to Reproduce\n\n### Method 1: Using ImageMagick directly\n\n```bash\nmagick MSL:recursive.msl out.png\n```\n\n### Method 2: Using OSS-Fuzz reproduce\n\n```bash\npython3 infra/helper.py build_fuzzers imagemagick\npython3 infra/helper.py reproduce imagemagick msl_fuzzer recursive.msl\n```\n\nOr run the fuzzer directly:\n```bash\n./msl_fuzzer recursive.msl\n```\n\n## Expected Behavior\n\nImageMagick should handle recursive MSL references gracefully by detecting the loop and returning an error.\n\n## Actual Behavior\n\nStack overflow causes process crash:\n\n```\nAddressSanitizer:DEADLYSIGNAL\n==PID==ERROR: AddressSanitizer: stack-overflow\n    #0 MSLStartElement /src/imagemagick/coders/msl.c:7045\n    #1 xmlParseStartTag /src/libxml2/parser.c\n    #2 xmlParseChunk /src/libxml2/parser.c:11273\n    #3 ProcessMSLScript /src/imagemagick/coders/msl.c:7405\n    #4 WriteMSLImage /src/imagemagick/coders/msl.c:7867\n    #5 WriteImage /src/imagemagick/MagickCore/constitute.c:1346\n    #6 MSLStartElement /src/imagemagick/coders/msl.c:7045\n    ... (infinite recursion, 287+ frames)\n```\n\n## Root Cause Analysis\n\nIn `coders/msl.c`, the `<write>` command handler in `MSLStartElement()` (line ~7045) calls `WriteImage()`. When the output filename specifies MSL format (`msl:filename`), `WriteMSLImage()` is called, which parses the MSL file again via `ProcessMSLScript()`.\n\nIf the MSL file references itself (directly or indirectly), this creates an infinite recursion loop:\n\n```\nMSLStartElement() → WriteImage() → WriteMSLImage() → ProcessMSLScript()\n    → xmlParseChunk() → MSLStartElement() → ... (infinite loop)\n```\n\n## Impact\n\n- **DoS**: Guaranteed crash via stack exhaustion\n- **Affected**: Any application using ImageMagick to process user-supplied MSL files\n\n## Additional Trigger Paths\n\nThe `<read>` command can also trigger recursion:\n\nIndirect recursion is also possible (a.msl → b.msl → a.msl).\n\n## Fuzzer\n\nThis issue was discovered using a custom MSL fuzzer:\n\n```cpp\n#include <cstdint>\n#include <Magick++/Blob.h>\n#include <Magick++/Image.h>\n#include \"utils.cc\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)\n{\n  if (IsInvalidSize(Size))\n    return(0);\n  try\n  {\n    const Magick::Blob blob(Data, Size);\n    Magick::Image image;\n    image.magick(\"MSL\");\n    image.fileName(\"MSL:\");\n    image.read(blob);\n  }\n  catch (Magick::Exception)\n  {\n  }\n  return(0);\n}\n```\n\nThis issue was found by Team FuzzingBrain @ Texas A&M University","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23874.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23874.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23874","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05271","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05267","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05225","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05041","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05101","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05134","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0515","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05125","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05108","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05093","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05194","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05051","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05046","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0508","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23874"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23874","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23874"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9vj4-wc7r-p844","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-20T21:37:11Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9vj4-wc7r-p844"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23874","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23874"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126075","reference_id":"1126075","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126075"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431034","reference_id":"2431034","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431034"},{"reference_url":"https://github.com/advisories/GHSA-9vj4-wc7r-p844","reference_id":"GHSA-9vj4-wc7r-p844","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9vj4-wc7r-p844"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61604?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bd1g-sfsp-37h7"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-z9t9-bxf9-hkfk"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.2"}],"aliases":["CVE-2026-23874","GHSA-9vj4-wc7r-p844"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vaks-d4k5-zue7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24627?format=json","vulnerability_id":"VCID-vpdn-g1k9-1kdn","summary":"ImageMagick has heap buffer overflow in YUV 4:2:2 decoder\nA heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer.\n\n```\n=================================================================\n==204642==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5170000002e0 at pc 0x562d21a7e8de bp 0x7fffa9ae1270 sp 0x7fffa9ae1260\nWRITE of size 8 at 0x5170000002e0 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25986.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25986.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25986","reference_id":"","reference_type":"","scores":[{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07243","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07208","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07188","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07242","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07269","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07266","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07252","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.0723","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07257","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.0725","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07292","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07168","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07174","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19294","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25986"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25986","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25986"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:06:36Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442111","reference_id":"2442111","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442111"},{"reference_url":"https://github.com/advisories/GHSA-mqfc-82jx-3mr2","reference_id":"GHSA-mqfc-82jx-3mr2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mqfc-82jx-3mr2"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25986","GHSA-mqfc-82jx-3mr2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vpdn-g1k9-1kdn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20978?format=json","vulnerability_id":"VCID-x44m-x33k-hydn","summary":"ImageMagick: Heap-based Buffer Overflow in GetPixelIndex due to metadata-cache desynchronization\n`OpenPixelCache`  updates image channel metadata **before** attempting pixel cache memory allocation. When both memory and disk allocation fail a heap-buffer-overflow read in occurs in any writer that calls `GetPixelIndex`.","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77"},{"reference_url":"https://github.com/advisories/GHSA-gq5v-qf8q-fp77","reference_id":"GHSA-gq5v-qf8q-fp77","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gq5v-qf8q-fp77"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["GHSA-gq5v-qf8q-fp77"],"risk_score":1.5,"exploitability":"0.5","weighted_severity":"3.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x44m-x33k-hydn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24594?format=json","vulnerability_id":"VCID-x8c6-9pse-xkc8","summary":"ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write\nAn integer overflow in DIB coder can result in out of bounds read or write","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28693.json","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28693.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28693","reference_id":"","reference_type":"","scores":[{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18595","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18515","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18798","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18648","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18744","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20102","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.19884","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.19914","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.19919","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20029","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.2003","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20026","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20148","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20044","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28693"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28693","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28693"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T15:57:44Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445888","reference_id":"2445888","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445888"},{"reference_url":"https://github.com/advisories/GHSA-hffp-q43q-qq76","reference_id":"GHSA-hffp-q43q-qq76","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hffp-q43q-qq76"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:6713","reference_id":"RHSA-2026:6713","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:6713"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28693","GHSA-hffp-q43q-qq76"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x8c6-9pse-xkc8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21101?format=json","vulnerability_id":"VCID-xbsu-ac6g-53fn","summary":"ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions\n`WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write.\n```\n==1575126==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc382ef3820 at pc 0x5560d31f229f bp 0x7ffe865f9530 sp 0x7ffe865f9520\nWRITE of size 8 at 0x7fc382ef3820 thread T0\n    #0 0x5560d31f229e in WriteUHDRImage coders/uhdr.c:807\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25794.json","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25794.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25794","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04999","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05003","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04961","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04924","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18197","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18251","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.17952","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18038","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18098","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18107","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18063","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18013","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.17955","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.17966","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25794"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/ffe589df5ff8ce1433daa4ccb0d2a9fadfbe30ed","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/ffe589df5ff8ce1433daa4ccb0d2a9fadfbe30ed"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhqj-f5cj-9x8h","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:04:46Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhqj-f5cj-9x8h"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25794","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25794"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442110","reference_id":"2442110","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442110"},{"reference_url":"https://github.com/advisories/GHSA-vhqj-f5cj-9x8h","reference_id":"GHSA-vhqj-f5cj-9x8h","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vhqj-f5cj-9x8h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25794","GHSA-vhqj-f5cj-9x8h"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xbsu-ac6g-53fn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24675?format=json","vulnerability_id":"VCID-y4hn-6bv6-jugw","summary":"ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.\nA stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.\n\n```\n=================================================================\n==278522==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdb8c76984 at pc 0x55a4bf16f507 bp 0x7ffdb8c75bc0 sp 0x7ffdb8c75bb0\nWRITE of size 1 at 0x7ffdb8c76984 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25968.json","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25968.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25968","reference_id":"","reference_type":"","scores":[{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.18911","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19061","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19141","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19194","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19201","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19155","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.191","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19059","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.1907","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19079","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.18969","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.18954","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19294","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19346","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25968"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25968","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25968"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25968","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25968"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442125","reference_id":"2442125","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442125"},{"reference_url":"https://github.com/advisories/GHSA-3mwp-xqp2-q6ph","reference_id":"GHSA-3mwp-xqp2-q6ph","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3mwp-xqp2-q6ph"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25968","GHSA-3mwp-xqp2-q6ph"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y4hn-6bv6-jugw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24481?format=json","vulnerability_id":"VCID-y58b-be93-hbfd","summary":"ImageMagick: Write heap-buffer-overflow in PCL encoder via undersized output buffer\nA heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation.\n\n```\nWRITE of size 1 at 0x7e79f91f31a0 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28686.json","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28686.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28686","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04143","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04189","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04175","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04127","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04109","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04841","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05016","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05021","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0498","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04944","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04799","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0479","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04881","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04861","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28686"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28686","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28686"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-467j-76j7-5885","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:24:19Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-467j-76j7-5885"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28686","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28686"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445889","reference_id":"2445889","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445889"},{"reference_url":"https://github.com/advisories/GHSA-467j-76j7-5885","reference_id":"GHSA-467j-76j7-5885","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-467j-76j7-5885"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28686","GHSA-467j-76j7-5885"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y58b-be93-hbfd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22330?format=json","vulnerability_id":"VCID-yx7r-r7ez-7uhp","summary":"ImageMagick: Code Injection via PostScript header in ps coders\nThe ps encoders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header.  An attacker can provide a malicious file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed.\n\nThe html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25797.json","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25797.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25797","reference_id":"","reference_type":"","scores":[{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.068","published_at":"2026-04-02T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00827","published_at":"2026-04-26T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00826","published_at":"2026-04-24T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00823","published_at":"2026-04-21T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00779","published_at":"2026-04-18T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00775","published_at":"2026-04-16T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00786","published_at":"2026-04-09T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00822","published_at":"2026-04-29T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00774","published_at":"2026-04-12T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.0078","published_at":"2026-04-11T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00789","published_at":"2026-04-04T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.0079","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25797"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25797","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25797"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/26088a83d71e9daa203d54a56fe3c31f3f85463d","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/26088a83d71e9daa203d54a56fe3c31f3f85463d"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:13:11Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25797","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25797"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442106","reference_id":"2442106","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442106"},{"reference_url":"https://github.com/advisories/GHSA-rw6c-xp26-225v","reference_id":"GHSA-rw6c-xp26-225v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rw6c-xp26-225v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25797","GHSA-rw6c-xp26-225v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yx7r-r7ez-7uhp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21517?format=json","vulnerability_id":"VCID-z9t9-bxf9-hkfk","summary":"ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths\n### Summary\n\nIn `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service.\n\n```\nDirect leak of 13512 byte(s) in 1 object(s) allocated from:\n    #0 0x7f5c11e27887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145\n    #1 0x55cdc38f65c4 in AcquireMagickMemory MagickCore/memory.c:536\n    #2 0x55cdc38f65eb in AcquireCriticalMemory MagickCore/memory.c:612\n    #3 0x55cdc3899e91 in AcquireImage MagickCore/image.c:154\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25796.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25796.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25796","reference_id":"","reference_type":"","scores":[{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07094","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07134","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07128","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07163","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07031","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07048","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07111","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.0712","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07131","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07133","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07101","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07047","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07072","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18987","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25796"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25796","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25796"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/93ad259ce4f6d641eea0bee73f374af90f35efc3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/93ad259ce4f6d641eea0bee73f374af90f35efc3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:11:19Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442112","reference_id":"2442112","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442112"},{"reference_url":"https://github.com/advisories/GHSA-g2pr-qxjg-7r2w","reference_id":"GHSA-g2pr-qxjg-7r2w","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g2pr-qxjg-7r2w"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25796","GHSA-g2pr-qxjg-7r2w"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-z9t9-bxf9-hkfk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21546?format=json","vulnerability_id":"VCID-zab9-9tqj-hbhg","summary":"ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder\nA crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort.\n\nFound via AFL++ fuzzing with afl-clang-lto instrumentation and AddressSanitizer.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25985.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25985.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25985","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04961","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04745","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04767","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04782","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04815","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04827","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04792","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04773","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04725","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04734","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04879","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04916","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04955","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25985"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25985","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25985"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/1a51eb9af00c36724660e294520878fd1f13e312","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/1a51eb9af00c36724660e294520878fd1f13e312"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:05:38Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442127","reference_id":"2442127","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442127"},{"reference_url":"https://github.com/advisories/GHSA-v7g2-m8c5-mf84","reference_id":"GHSA-v7g2-m8c5-mf84","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v7g2-m8c5-mf84"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:5573","reference_id":"RHSA-2026:5573","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:5573"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["CVE-2026-25985","GHSA-v7g2-m8c5-mf84"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zab9-9tqj-hbhg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24592?format=json","vulnerability_id":"VCID-zpcy-nms7-kuha","summary":"ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder\nAn integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted mage.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28493.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28493.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28493","reference_id":"","reference_type":"","scores":[{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17414","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17322","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17474","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17542","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17495","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18877","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18682","published_at":"2026-04-29T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18725","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18746","published_at":"2026-04-24T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18858","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18843","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.1883","published_at":"2026-04-16T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18975","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18928","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28493"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r39q-jr8h-gcq2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T17:16:54Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r39q-jr8h-gcq2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28493","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28493"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445883","reference_id":"2445883","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445883"},{"reference_url":"https://github.com/advisories/GHSA-r39q-jr8h-gcq2","reference_id":"GHSA-r39q-jr8h-gcq2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r39q-jr8h-gcq2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65270?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jc5m-7rvc-2qg6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.4"}],"aliases":["CVE-2026-28493","GHSA-r39q-jr8h-gcq2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zpcy-nms7-kuha"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21962?format=json","vulnerability_id":"VCID-zx14-t8et-ufcq","summary":"ImageMagick: Memory leak in coders/txt.c without freetype\nIf a `texture` attribute is specified for a TXT file, an attempt will be made to read it via `texture=ReadImage(read_info,exception);`. Later, when retrieving metrics via the `GetTypeMetrics` function, if this function fails (i.e., `status == MagickFalse`), the calling function will exit immediately but fail to release the texture object, leading to memory leakage.","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/e6394098af39a9689bb5f0b4eb6a9968e449a8d3","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/e6394098af39a9689bb5f0b4eb6a9968e449a8d3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8"},{"reference_url":"https://github.com/advisories/GHSA-3q5f-gmjc-38r8","reference_id":"GHSA-3q5f-gmjc-38r8","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3q5f-gmjc-38r8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62605?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"}],"aliases":["GHSA-3q5f-gmjc-38r8"],"risk_score":1.4,"exploitability":"0.5","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zx14-t8et-ufcq"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.9.1"}