CVE Vulnerability Catalog

Prior to version 7.1.2-31 of ImageMagick, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. This issue is fixed in version 7.1.2-31.

Prior to versions 7.1.2-31 and 6.9.13-56 of ImageMagick, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Prior to versions 7.1.2-30 and 6.9.13-55 of ImageMagick, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

Prior to versions 6.9.13-56 and 7.1.2-31 of ImageMagick, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in versions 6.9.13-56 and 7.1.2-31.

Prior to version 7.1.2-32 of ImageMagick, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is fixed in version 7.1.2-32.

Prior to version 7.1.2-32 of ImageMagick, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32.

Prior to versions 7.1.2-32 and 6.9.13-57 of ImageMagick, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.

Prior to versions 7.1.2-32 and 6.9.13-57 of ImageMagick, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.

In ImageMagick prior to 7.1.2-32, the delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable. This allows a local privileged workflow to overwrite a file with random data. The issue is fixed in version 7.1.2-32.

In ImageMagick prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop. This exhausts processing resources. The issue is fixed in versions 7.1.2-32 and 6.9.13-57.

In ImageMagick prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer. This causes the process to crash. The issue is fixed in version 7.1.2-32.

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, leading to out-of-bounds reads and disclosure of adjacent heap memory, including heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR.

In praisonai-platform prior to 0.1.9, dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading specially crafted file metadata.

A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. An authenticated administrator can submit a value containing shell metacharacters, leading to arbitrary OS command execution with root privileges.

A flaw was found in source-to-image where unpacking archive files fails to properly sanitize symbolic links pointing to absolute file paths. An attacker supplying a malicious builder image can embed links pointing outside the extraction directory. This bypasses sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.

A flaw was found in m17n-lib where an attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).

A flaw was found in m17n-lib where a user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.

A flaw has been found in XnView Classic 2.52.5 in an unknown function of the FLI File Parser component. Manipulation of the starting_line argument causes a heap-based buffer overflow. Remote exploitation is possible. Upgrading to version 2.52.6 is recommended.

In Backstage prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in a deprecated Kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. This issue is fixed in version 0.21.8.