Skip to main content

ImageMagick CVE-2026-53465

MEDIUM
Heap-based Buffer Overflow (CWE-122)
2026-06-10 GitHub_M GHSA-44cp-c3ww-9rv5
Heap Overflow Buffer Overflow Imagemagick
6.2
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.8 MEDIUM

Local vector per vendor; heap over-write write primitive justifies I:L addition over official I:N; PR:N as no OS privileges needed to supply a crafted file.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Red Hat
6.2 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 10, 2026 - 22:51 vuln.today

DescriptionCVE.org

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, a crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder. This issue has been patched in version 7.1.2-25.

AnalysisAI

Heap-based buffer over-write in ImageMagick's SF3 encoder prior to version 7.1.2-25 allows an attacker who can supply a crafted multi-frame image to corrupt heap memory, yielding high availability impact and potential integrity exposure. All ImageMagick installations before 7.1.2-25 are affected regardless of platform. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; however, CWE-122 write primitives carry inherent escalation risk beyond the scored DoS impact depending on heap layout at time of trigger.

Technical ContextAI

ImageMagick (CPE: cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*) is a widely deployed open-source image processing suite used as a standalone CLI tool and as an embedded library in web applications, content management systems, and automated media pipelines. The vulnerability resides in the SF3 encoder component, which is responsible for encoding multi-frame image sequences. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: during encoding of a specially crafted multi-frame input, the encoder writes beyond the bounds of a heap-allocated buffer. This class of flaw typically originates from missing or incorrect bounds validation on frame count calculations or loop iteration limits during buffer population, allowing attacker-controlled data to overwrite adjacent heap memory - a write primitive more dangerous than a read overflow because it directly manipulates runtime data structures.

RemediationAI

Vendor-released patch: 7.1.2-25. Upgrade ImageMagick to version 7.1.2-25 or later as documented in GitHub Security Advisory GHSA-44cp-c3ww-9rv5 at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-44cp-c3ww-9rv5. For deployments that cannot immediately upgrade, implement an explicit input format allowlist at the application layer that excludes SF3 format processing, preventing the vulnerable encoder from being invoked entirely - note this will break any legitimate SF3 encoding use cases. Additionally, sandboxing ImageMagick subprocesses using seccomp profiles or AppArmor/SELinux policies can limit the blast radius of heap corruption by restricting memory operations and process capabilities. Enforcing memory limits (ulimit -v) on ImageMagick worker processes can also cap availability impact by bounding the damage from a triggered crash to the sandboxed process rather than the parent application.

More in Imagemagick

View all
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
CVE-2023-34152 CRITICAL POC
9.8 May 30

A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2019-19952 CRITICAL POC
9.8 Dec 24

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
CVE-2018-14551 CRITICAL POC
9.8 Jul 23

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Heap Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-5419 HIGH POC
8.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8
CVE-2023-6246 HIGH POC
8.4

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected

Share

CVE-2026-53465 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy