Veille CVE

Semaine du 6 juillet au 12 juillet 2026

11 CVE

Critique 2 Élevée 4 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « ImageMagick » ✕
  1. CVE-2026-61870 7.5 Élevée

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.

  2. CVE-2026-61861 7.5 Élevée

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.

  3. CVE-2026-61858 5.3 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.

  4. CVE-2026-61857 7.5 Élevée

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

  5. CVE-2026-61465 6.5 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.

  6. CVE-2026-56372 9.1 Critique

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.

  7. CVE-2026-56373 5.3 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.

  8. CVE-2026-56366 6.5 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.

  9. CVE-2026-56374 7.1 Élevée

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of service or information disclosure.

  10. CVE-2026-56362 4.2 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting any writer calling GetPixelIndex.

  11. CVE-2026-6382 9.1 Critique

    Unknown FileOrganizer · Unknown Advanced File Manager · Unknown File Manager Pro · Unknown File Manager

    The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.