CVE-2026-106567

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.

ImageMagick before 6.9.13-57 and 7.1.2-32 contains a type confusion flaw in the INFO, JSON, and YAML encoders when writing compressed images, causing an unexpected pointer type. An attacker can trigger a process crash via SIGABRT or SIGSEGV, leading to denial of service.

ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.

ImageMagick before 7.1.2-32 has a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use -script to close file descriptors not opened by the current operation, circumventing security policies.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.

ImageMagick 7.1.1-31 before 7.1.2-32 has a NULL pointer dereference in the PostScript decoder triggered when a policy limit is reached. Attackers can supply a crafted PostScript file to crash the application, causing denial of service.

ImageMagick 7.1.2-30 before 7.1.2-32 has a use-after-free vulnerability in the WBINFO decoder when memory allocation fails during image decoding. Attackers can supply a crafted image that, under memory allocation failure, causes freed memory to be reused, crashing the application.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.