Technology · ImageMagick
ImageMagick vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 143 vulnerabilities in ImageMagick: 0 in the last 7 days and 49 in the last 90 days, 3 of them critical and 3 exploited in the wild. The most recent, CVE-2026-123273, was published on 5 November 2026. 17 vulnerabilities in the last four weeks, down 35% on the four before (26).
- Last 7 days
- 0
- Last 90 days
- 49
- Critical, all time
- 3
- Exploited in the wild
- 3
About ImageMagick
ImageMagick is a command-line and programming library for creating, editing, and converting raster and vector images.
Latest ImageMagick vulnerabilities
- CVE-2026-123273: ImageMagick infinite loop in SVG decodermediumCVSS 6.5
- CVE-2026-116155: ImageMagick memory leak in XMP profile handlingmediumCVSS 5.3
- CVE-2026-116154: ImageMagick memory leak in XML parsing depth limitmediumCVSS 5.3
- CVE-2026-116152: ImageMagick memory leak in MAT decodermediumCVSS 5.3
- CVE-2026-116149: ImageMagick stack buffer overflow in bzip2 decompressionhighCVSS 8.1
- CVE-2026-116141: ImageMagick policy bypass in UHDR decodermediumCVSS 5.3
- CVE-2026-109964: ImageMagick heap buffer underwrite in PICT decodermediumCVSS 5.6EPSS 0.4%
- CVE-2026-109281: ImageMagick heap buffer over-read in -fx optionmediumCVSS 4.4EPSS 0.1%
- CVE-2026-109276: ImageMagick temporary file leak in JNG decodermediumCVSS 5.3EPSS 0.4%
- CVE-2026-109275: ImageMagick code injection in MVG decoder with PostScript renderermediumCVSS 4.8EPSS 0.3%
- CVE-2026-109273: ImageMagick information disclosure in PostScript decodermediumCVSS 5.3EPSS 0.3%
- CVE-2026-109269: ImageMagick JPEG decoder information disclosuremediumCVSS 5.3EPSS 0.3%
- CVE-2026-109267: ImageMagick stack overflow in MSL decodermediumCVSS 5.3EPSS 0.4%
- CVE-2026-109266: ImageMagick XML injection in CIP encodermediumCVSS 5.3EPSS 0.3%
- CVE-2026-109265: ImageMagick heap buffer over-read in XMP profile parsingmediumCVSS 5.3EPSS 0.4%
- CVE-2026-109262: ImageMagick memory leak in SVG encoder WriteSVGImagemediumCVSS 5.3EPSS 0.4%
- CVE-2026-109259: ImageMagick uninitialized memory read in TGA decodermediumCVSS 5.3EPSS 0.3%
- CVE-2026-108693: ImageMagick uncontrolled search path in NTGhostscriptEXE()highCVSS 7EPSS 0.1%
- CVE-2026-107210: ImageMagick resource exhaustion in MAT decodermediumCVSS 5.3EPSS 0.3%
- CVE-2026-107209: ImageMagick double free in RSVG decodermediumCVSS 5.9EPSS 0.3%
- CVE-2026-107208: ImageMagick denial of service in XMP profile parsingmediumCVSS 5.3EPSS 0.3%
- CVE-2026-106580: ImageMagick missing security-policy check in CUT encodermediumCVSS 4EPSS 0.1%
- CVE-2026-106579: ImageMagick coder security policy bypassmediumCVSS 6.2EPSS 0.1%
- CVE-2026-106578: ImageMagick invalid memory free in MVG decodermediumCVSS 5.9EPSS 0.4%
- CVE-2026-106577: ImageMagick code injection in PostScript codermediumCVSS 5.3EPSS 0.3%
Most severe ImageMagick vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2016-3714: ImageMagick Improper Input Validation Vulnerabilitycriticalexploited in the wildCVSS 8.4
- CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerabilitycriticalexploited in the wildCVSS 5.5
- CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerabilitycriticalexploited in the wildCVSS 5.5
- CVE-2026-25965: ImageMagick path traversal policy bypass in path security policyhighCVSS 8.6EPSS 0.8%
- CVE-2026-25794: ImageMagick heap overflow in WriteUHDRImagehighCVSS 8.2EPSS 0.6%
- CVE-2026-28693: ImageMagick integer overflow in DIB coderhighCVSS 8.1EPSS 0.6%
- CVE-2026-23876: ImageMagick heap buffer overflow in XBM image decoderhighCVSS 8.1EPSS 0.5%
- CVE-2026-116149: ImageMagick stack buffer overflow in bzip2 decompressionhighCVSS 8.1
- CVE-2026-46522: ImageMagick infinite loop in MIFF decoderhighCVSS 7.5EPSS 1.9%
- CVE-2026-33901: ImageMagick heap buffer overflow in MVG decoderhighCVSS 7.5EPSS 0.7%
Vulnerabilities per week
17 vulnerabilities in the last four weeks, down 35% on the four before (26). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 6 | 0 | |
| 14 Sep 2026 | 5 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 21 | 0 | |
| 12 Oct 2026 | 11 | 0 | |
| 19 Oct 2026 | 5 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many ImageMagick vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/imagemagick)<a href="https://junglewise.ai/threats/technologies/imagemagick"><img src="https://junglewise.ai/threats/technologies/imagemagick/badge.svg" alt="ImageMagick vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/imagemagick.json, and this page as text at https://junglewise.ai/threats/technologies/imagemagick.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "ImageMagick vulnerabilities", https://junglewise.ai/threats/technologies/imagemagick, 13 November 2026.