CVE-2026-107210

ImageMagick prior to versions 7.1.2-30 and 6.9.13-55, when built without Cairo support, contains a vulnerability where a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

ImageMagick prior to versions 7.1.2-30 and 6.9.13-55 contains a vulnerability where a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

ImageMagick prior to versions 7.1.2-31 and 6.9.13-56 contains a vulnerability where a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

ImageMagick prior to versions 7.1.2-31 and 6.9.13-56 contains a vulnerability where a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

ImageMagick prior to versions 7.1.2-31 and 6.9.13-56 contains a vulnerability where a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

ImageMagick prior to versions 7.1.2-31 and 6.9.13-56 contains a vulnerability where unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Prior to version 7.1.2-31 of ImageMagick, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31.

Prior to version 7.1.2-31 of ImageMagick, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31.

Prior to version 7.1.2-31 of ImageMagick, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. This issue is fixed in version 7.1.2-31.

Prior to versions 7.1.2-31 and 6.9.13-56 of ImageMagick, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.