# ImageMagick vulnerabilities Source: https://junglewise.ai/threats/vendors/imagemagick Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/imagemagick.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 142 vulnerabilities in ImageMagick: 0 in the last 7 days and 48 in the last 90 days, 3 of them critical and 3 exploited in the wild. The most recent, CVE-2026-123273, was published on 5 November 2026. 16 vulnerabilities in the last four weeks, down 38% on the four before (26). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 48 - All time: 142 (3 critical, 3 exploited in the wild) ## About ImageMagick A suite of command-line tools and libraries for creating, editing, and converting raster images. ## Latest ImageMagick vulnerabilities - [CVE-2026-123273: ImageMagick infinite loop in SVG decoder](https://junglewise.ai/threats/cve-2026-123273-imagemagick-before-7-1-2-35-and-6-9-13-60-contains-an-infinite) (medium, CVSS 6.5, published 5 Nov 2026) - [CVE-2026-116155: ImageMagick memory leak in XMP profile handling](https://junglewise.ai/threats/cve-2026-116155-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a) (medium, CVSS 5.3, published 25 Oct 2026) - [CVE-2026-116154: ImageMagick memory leak in XML parsing depth limit](https://junglewise.ai/threats/cve-2026-116154-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a) (medium, CVSS 5.3, published 25 Oct 2026) - [CVE-2026-116152: ImageMagick memory leak in MAT decoder](https://junglewise.ai/threats/cve-2026-116152-imagemagick-before-7-1-2-33-contains-a-memory-leak-vulnerability) (medium, CVSS 5.3, published 25 Oct 2026) - [CVE-2026-116149: ImageMagick stack buffer overflow in bzip2 decompression](https://junglewise.ai/threats/cve-2026-116149-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a) (high, CVSS 8.1, published 25 Oct 2026) - [CVE-2026-116141: ImageMagick policy bypass in UHDR decoder](https://junglewise.ai/threats/cve-2026-116141-imagemagick-before-7-1-2-33-contains-a-policy-bypass) (medium, CVSS 5.3, published 25 Oct 2026) - [CVE-2026-109964: ImageMagick heap buffer underwrite in PICT decoder](https://junglewise.ai/threats/cve-2026-109964-imagemagick-before-7-1-2-33-and-6-9-13-58-contains-a-heap-buffer) (medium, CVSS 5.6, published 13 Oct 2026) - [CVE-2026-109281: ImageMagick heap buffer over-read in -fx option](https://junglewise.ai/threats/cve-2026-109281-imagemagick-7-1-0-21-before-7-1-2-32-contains-a-heap-buffer-over) (medium, CVSS 4.4, published 12 Oct 2026) - [CVE-2026-109276: ImageMagick temporary file leak in JNG decoder](https://junglewise.ai/threats/cve-2026-109276-imagemagick-before-6-9-13-57-and-7-x-before-7-1-2-32-contains-an) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109273: ImageMagick information disclosure in PostScript decoder](https://junglewise.ai/threats/cve-2026-109273-imagemagick-before-6-9-13-57-and-7-x-before-7-1-2-32-contains-an) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109269: ImageMagick JPEG decoder information disclosure](https://junglewise.ai/threats/cve-2026-109269-imagemagick-before-6-9-13-57-and-7-x-before-7-1-2-32-contains-an) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109267: ImageMagick stack overflow in MSL decoder](https://junglewise.ai/threats/cve-2026-109267-imagemagick-before-6-9-13-57-and-7-x-before-7-1-2-32-contains-a) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109266: ImageMagick XML injection in CIP encoder](https://junglewise.ai/threats/cve-2026-109266-imagemagick-before-6-9-13-57-and-7-x-before-7-1-2-32-contains-an) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109265: ImageMagick heap buffer over-read in XMP profile parsing](https://junglewise.ai/threats/cve-2026-109265-imagemagick-7-1-1-7-before-7-1-2-32-contains-a-heap-buffer-over) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109262: ImageMagick memory leak in SVG encoder WriteSVGImage](https://junglewise.ai/threats/cve-2026-109262-imagemagick-before-6-9-13-57-and-7-x-before-7-1-2-32-contains-a) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109259: ImageMagick uninitialized memory read in TGA decoder](https://junglewise.ai/threats/cve-2026-109259-imagemagick-before-6-9-13-57-and-7-x-before-7-1-2-32-contains-an) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-108693: ImageMagick uncontrolled search path in NTGhostscriptEXE()](https://junglewise.ai/threats/cve-2026-108693-imagemagick-on-windows-through-7-1-2-33-and-6-9-13-58-contains) (high, CVSS 7, published 11 Oct 2026) - [CVE-2026-107210: ImageMagick resource exhaustion in MAT decoder](https://junglewise.ai/threats/cve-2026-107210-imagemagick-is-free-and-open-source-software-used-for-editing) (medium, CVSS 5.3, published 7 Oct 2026) - [CVE-2026-107209: ImageMagick double free in RSVG decoder](https://junglewise.ai/threats/cve-2026-107209-imagemagick-is-free-and-open-source-software-used-for-editing) (medium, CVSS 5.9, published 7 Oct 2026) - [CVE-2026-107208: ImageMagick denial of service in XMP profile parsing](https://junglewise.ai/threats/cve-2026-107208-imagemagick-is-free-and-open-source-software-used-for-editing) (medium, CVSS 5.3, published 7 Oct 2026) - [CVE-2026-106580: ImageMagick missing security-policy check in CUT encoder](https://junglewise.ai/threats/cve-2026-106580-imagemagick-is-free-and-open-source-software-used-for-editing) (medium, CVSS 4, published 7 Oct 2026) - [CVE-2026-106579: ImageMagick coder security policy bypass](https://junglewise.ai/threats/cve-2026-106579-imagemagick-is-free-and-open-source-software-used-for-editing) (medium, CVSS 6.2, published 7 Oct 2026) - [CVE-2026-106578: ImageMagick invalid memory free in MVG decoder](https://junglewise.ai/threats/cve-2026-106578-imagemagick-is-free-and-open-source-software-used-for-editing) (medium, CVSS 5.9, published 7 Oct 2026) - [CVE-2026-106577: ImageMagick code injection in PostScript coder](https://junglewise.ai/threats/cve-2026-106577-imagemagick-is-free-and-open-source-software-used-for-editing) (medium, CVSS 5.3, published 7 Oct 2026) - [CVE-2026-106576: ImageMagick XMP profile denial of service](https://junglewise.ai/threats/cve-2026-106576-imagemagick-is-free-and-open-source-software-used-for-editing) (medium, CVSS 5.3, published 7 Oct 2026) ## Most severe ImageMagick vulnerabilities - [CVE-2016-3714: ImageMagick Improper Input Validation Vulnerability](https://junglewise.ai/threats/cve-2016-3714-imagemagick-improper-input-validation-vulnerability) (critical, exploited in the wild, CVSS 8.4, published 9 Sep 2024) - [CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability](https://junglewise.ai/threats/cve-2016-3718-imagemagick-server-side-request-forgery-ssrf-vulnerability) (critical, exploited in the wild, CVSS 5.5, published 3 Nov 2021) - [CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability](https://junglewise.ai/threats/cve-2016-3715-imagemagick-arbitrary-file-deletion-vulnerability) (critical, exploited in the wild, CVSS 5.5, published 3 Nov 2021) - [CVE-2026-25965: ImageMagick path traversal policy bypass in path security policy](https://junglewise.ai/threats/cve-2026-25965-imagemagick-path-traversal-policy-bypass-in-path-security-policy) (high, CVSS 8.6, published 24 Feb 2026) - [CVE-2026-25794: ImageMagick heap overflow in WriteUHDRImage](https://junglewise.ai/threats/cve-2026-25794-imagemagick-heap-overflow-in-writeuhdrimage) (high, CVSS 8.2, published 24 Feb 2026) - [CVE-2026-28693: ImageMagick integer overflow in DIB coder](https://junglewise.ai/threats/cve-2026-28693-imagemagick-integer-overflow-in-dib-coder) (high, CVSS 8.1, published 10 Mar 2026) - [CVE-2026-23876: ImageMagick heap buffer overflow in XBM image decoder](https://junglewise.ai/threats/cve-2026-23876-imagemagick-heap-buffer-overflow-in-xbm-image-decoder) (high, CVSS 8.1, published 20 Jan 2026) - [CVE-2026-116149: ImageMagick stack buffer overflow in bzip2 decompression](https://junglewise.ai/threats/cve-2026-116149-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a) (high, CVSS 8.1, published 25 Oct 2026) - [CVE-2026-46522: ImageMagick infinite loop in MIFF decoder](https://junglewise.ai/threats/cve-2026-46522-imagemagick-infinite-loop-in-miff-decoder) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-33901: ImageMagick heap buffer overflow in MVG decoder](https://junglewise.ai/threats/cve-2026-33901-imagemagick-heap-buffer-overflow-in-mvg-decoder) (high, CVSS 7.5, published 13 Apr 2026) ## Vulnerabilities per week 16 vulnerabilities in the last four weeks, down 38% on the four before (26). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 6 | 0 | 0 | | 14 Sep 2026 | 5 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 21 | 0 | 0 | | 12 Oct 2026 | 10 | 0 | 0 | | 19 Oct 2026 | 5 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## ImageMagick technologies - [ImageMagick](https://junglewise.ai/threats/technologies/imagemagick): 143 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "ImageMagick vulnerabilities", https://junglewise.ai/threats/vendors/imagemagick, 13 November 2026.