Vulnerability-Lookup

WID-SEC-W-2026-3867

Vulnerability from csaf_certbund - Published: 2026-10-11 22:00 - Updated: 2026-10-13 22:00

Summary

ImageMagick: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann.

Angriff: Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen, den Speicher zu beschädigen, Cross-Site-Scripting-Angriffe durchzuführen, einen Denial-of-Service-Angriff auszulösen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme: - Linux - MacOS X - UNIX - Windows

CVE-2026-108693

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Open Source ImageMagick <6.9.13-58 Open Source / ImageMagick		<6.9.13-58
Open Source ImageMagick <7.1.2-33 Open Source / ImageMagick		<7.1.2-33

CVE-2026-105081

Affected products

Known affected 2 products, the same list as for CVE-2026-108693

CVE-2026-109964

Affected products

Known affected 2 products, the same list as for CVE-2026-108693

References

27 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/advisories/GHSA-92C8-5JFQ-J2VJ	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external
https://github.com/ImageMagick/ImageMagick/securi…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuf\u00fchren, den Speicher zu besch\u00e4digen, Cross-Site-Scripting-Angriffe durchzuf\u00fchren, einen Denial-of-Service-Angriff auszul\u00f6sen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-3867 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3867.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-3867 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3867"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-11",
        "url": "https://github.com/advisories/GHSA-92C8-5JFQ-J2VJ"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-5222-mhv9-26rg vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5222-mhv9-26rg"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-528x-2384-jmxp vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-528x-2384-jmxp"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-5jf2-9gcp-q234 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5jf2-9gcp-q234"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-6p6q-wfrv-ffhh vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p6q-wfrv-ffhh"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-7438-vh5v-v52h vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7438-vh5v-v52h"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-79p5-w6jv-r997 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-7r5g-p7ff-jgcp vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7r5g-p7ff-jgcp"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-83w9-w85j-h9jc vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-83w9-w85j-h9jc"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-8ghq-p369-g395 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8ghq-p369-g395"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-8w9c-hj38-8pf9 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8w9c-hj38-8pf9"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-c2qq-jqw7-q4mx vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-c2qq-jqw7-q4mx"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-fp46-842c-2v83 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fp46-842c-2v83"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-h3qx-937j-245g vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-j2rp-5r6m-f7x8 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j2rp-5r6m-f7x8"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-j657-rmv3-4m94 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j657-rmv3-4m94"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-m938-565c-h9qf vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m938-565c-h9qf"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-mqmp-r5jh-jx7w vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-pj4h-g4pf-66v3 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-pwpf-8799-94cj vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-qq8x-fq3x-43h4 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qq8x-fq3x-43h4"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-v5f5-4v9x-p3f2 vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v5f5-4v9x-p3f2"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-v9q4-cm37-q2jm vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v9q4-cm37-q2jm"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-vm77-q83h-5fhg vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vm77-q83h-5fhg"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-x258-xjqf-6j3f vom 2026-10-11",
        "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x258-xjqf-6j3f"
      }
    ],
    "source_lang": "en-US",
    "title": "ImageMagick: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-10-13T22:00:00.000+00:00",
      "generator": {
        "date": "2026-10-13T18:04:15.847+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-3867",
      "initial_release_date": "2026-10-11T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-10-11T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-10-12T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE erg\u00e4nzt"
        },
        {
          "date": "2026-10-13T22:00:00.000+00:00",
          "number": "3",
          "summary": "CVE-2026-109964 erg\u00e4nzt"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.1.2-33",
                "product": {
                  "name": "Open Source ImageMagick \u003c7.1.2-33",
                  "product_id": "T060995"
                }
              },
              {
                "category": "product_version",
                "name": "7.1.2-33",
                "product": {
                  "name": "Open Source ImageMagick 7.1.2-33",
                  "product_id": "T060995-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:imagemagick:imagemagick:7.1.2-33"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c6.9.13-58",
                "product": {
                  "name": "Open Source ImageMagick \u003c6.9.13-58",
                  "product_id": "T060996"
                }
              },
              {
                "category": "product_version",
                "name": "6.9.13-58",
                "product": {
                  "name": "Open Source ImageMagick 6.9.13-58",
                  "product_id": "T060996-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:imagemagick:imagemagick:6.9.13-58"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ImageMagick"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-108693",
      "product_status": {
        "known_affected": [
          "T060996",
          "T060995"
        ]
      },
      "release_date": "2026-10-11T22:00:00.000+00:00",
      "title": "CVE-2026-108693"
    },
    {
      "cve": "CVE-2026-105081",
      "product_status": {
        "known_affected": [
          "T060996",
          "T060995"
        ]
      },
      "release_date": "2026-10-11T22:00:00.000+00:00",
      "title": "CVE-2026-105081"
    },
    {
      "cve": "CVE-2026-109964",
      "product_status": {
        "known_affected": [
          "T060996",
          "T060995"
        ]
      },
      "release_date": "2026-10-11T22:00:00.000+00:00",
      "title": "CVE-2026-109964"
    }
  ]
}

CVE-2026-105081 (GCVE-0-2026-105081)

Vulnerability from cvelistv5 – Published: 2026-10-12 13:10 – Updated: 2026-10-13 18:35

Title

ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName

Summary

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

3.6 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 18:35 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6045 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/ImageMagick/ImageMagick/securi…	vendor-advisory
https://www.vulncheck.com/advisories/imagemagick-…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
ImageMagick	ImageMagick	Affected: 0 , < 7.1.2-33 (semver) Unaffected: 7.1.2-33 (semver)
ImageMagick	ImageMagick	Affected: 0 , < 6.9.13-58 (semver) Unaffected: 6.9.13-58 (semver)

Date Public

2026-10-10 00:00

Credits

Scott Moore - VulnCheck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T18:35:34.310390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T18:35:47.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "lessThan": "7.1.2-33",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.1.2-33",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "lessThan": "6.9.13-58",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.9.13-58",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.2-33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.13-58",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Scott Moore - VulnCheck"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T13:10:29.543Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-79p5-w6jv-r997)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997"
        },
        {
          "name": "VulnCheck Advisory: ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-via-symlink-in-isrightsauthorizedbyname"
        }
      ],
      "title": "ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-105081",
    "datePublished": "2026-10-12T13:10:29.543Z",
    "dateReserved": "2026-10-03T00:43:57.788Z",
    "dateUpdated": "2026-10-13T18:35:47.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108693 (GCVE-0-2026-108693)

Vulnerability from cvelistv5 – Published: 2026-10-11 01:35 – Updated: 2026-10-13 19:53

Title

ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate

Summary

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 19:52 UTC

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6045 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/ghostx-86/exploitarium/tree/ma…	exploit
https://github.com/ImageMagick/ImageMagick/blob/2…	technical-description
https://github.com/ImageMagick/ImageMagick/blob/2…	technical-description
https://github.com/ImageMagick/ImageMagick	product
https://www.vulncheck.com/advisories/imagemagick-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ImageMagick	ImageMagick	Affected: 7.0.0-0 , ≤ 7.1.2-33 (custom) Affected: 0 , ≤ 6.9.13-58 (custom) cpe:2.3:a:imagemagick:imagemagick:::::::: cpe:2.3:a:imagemagick:imagemagick::::::::

Date Public

2026-06-23 00:00

Credits

Muhammad Ali Hasan Anwar

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108693",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T19:52:57.210419Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T19:53:08.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ImageMagick/ImageMagick",
          "product": "ImageMagick",
          "repo": "https://github.com/ImageMagick/ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "lessThanOrEqual": "7.1.2-33",
              "status": "affected",
              "version": "7.0.0-0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.9.13-58",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "7.1.2-33",
                  "versionStartIncluding": "7.0.0-0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "6.9.13-58",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhammad Ali"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Hasan Anwar"
        }
      ],
      "datePublic": "2026-06-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T01:35:43.626Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/ghostx-86/exploitarium/tree/main/imagemagick-gs-delegate-hijack-poc"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/blob/211e5b975a0019a88dcef5f84c1193f46738d815/MagickCore/nt-base.c#L1469-L1511"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/blob/211e5b975a0019a88dcef5f84c1193f46738d815/MagickCore/nt-base.c#L2829-L2832"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick"
        },
        {
          "name": "VulnCheck Advisory: ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/imagemagick-through-7.1.2-33-and-6.9.13-58-uncontrolled-search-path-via-ghostscript-delegate"
        }
      ],
      "title": "ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108693",
    "datePublished": "2026-10-11T01:35:43.626Z",
    "dateReserved": "2026-10-10T23:08:34.508Z",
    "dateUpdated": "2026-10-13T19:53:08.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109964 (GCVE-0-2026-109964)

Vulnerability from cvelistv5 – Published: 2026-10-13 13:35 – Updated: 2026-10-13 16:43

Title

ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder

Summary

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

5.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 15:47 UTC

CWE

CWE-124 - Buffer Underwrite ('Buffer Underflow')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6045 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/ImageMagick/ImageMagick/securi…	vendor-advisory
https://github.com/ImageMagick/ImageMagick/commit…	patch
https://github.com/ImageMagick/ImageMagick6/commi…	patch
https://github.com/ImageMagick/ImageMagick/blob/7…	technical-description
https://github.com/ImageMagick/ImageMagick	product
https://www.vulncheck.com/advisories/imagemagick-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ImageMagick	ImageMagick	Affected: 7.0.0-0 , < 7.1.2-33 (custom) Affected: 0 , < 6.9.13-58 (custom) cpe:2.3:a:imagemagick:imagemagick:::::::: cpe:2.3:a:imagemagick:imagemagick::::::::

Date Public

2026-09-29 00:00

Credits

idoprog

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109964",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:47:49.610741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:43:16.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ImageMagick/ImageMagick",
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "lessThan": "7.1.2-33",
              "status": "affected",
              "version": "7.0.0-0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.9.13-58",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.2-33",
                  "versionStartIncluding": "7.0.0-0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.13-58",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "idoprog"
        }
      ],
      "datePublic": "2026-09-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-124",
              "description": "Buffer Underwrite (\u0027Buffer Underflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T13:35:45.590Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-mqmp-r5jh-jx7w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick"
        },
        {
          "name": "VulnCheck Advisory: ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"
        }
      ],
      "title": "ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109964",
    "datePublished": "2026-10-13T13:35:45.590Z",
    "dateReserved": "2026-10-13T11:26:13.464Z",
    "dateUpdated": "2026-10-13T16:43:16.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2026-3867

CVE-2026-105081 (GCVE-0-2026-105081)

CVE-2026-108693 (GCVE-0-2026-108693)

CVE-2026-109964 (GCVE-0-2026-109964)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour