Veille CVE

Semaine du 7 septembre au 13 septembre 2026

7 CVE

Critique 0 Élevée 3 Moyenne 2 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « ImageMagick » ✕
  1. CVE-2026-73693 8.8 Élevée

    FileRun

    FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command substitution syntax such as backticks, semicolons, or $() sequences in the filename, then trigger the PhotoProofSheet endpoint to execute arbitrary commands as the web-server user due to missing escapeshellarg() sanitization in the ImageMagick montage command construction.

  2. CVE-2026-86425 5.5 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).

  3. CVE-2026-86424 2.5 Faible

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.

  4. CVE-2026-86423 5.5 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).

  5. CVE-2026-86422 3.3 Faible

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.

  6. CVE-2026-86421 7.5 Élevée

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

  7. CVE-2026-86420 7.5 Élevée

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.