p PatchFirst

PatchFirst · Latest vulnerabilities

graphicsmagick vulnerabilities

Vulnerabilities published for graphicsmagick in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 148

  1. CVE-2026-103118

    Medium · CVSS 5.3EPSS 0.29%Fix available

    GraphicsMagick WPG File wpg.c ExtractPostscript recursion

    A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

    graphicsmagickOperating systems
    • Update to 1.4+really1.3.48-2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-77118

    High · CVSS 8.4EPSS 0.17%Fix available

    Out-of-bounds write in GraphicsMagick PCD decoder

    A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through

    graphicsmagickOperating systems
    • Update to 1.4+really1.3.48-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-61464

    Low · CVSS 1EPSS 0.09%Fix available

    ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11

    ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service.

    graphicsmagickOperating systems
    • Update to 1.4+really1.3.49-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-56379

    Critical · CVSS 9.2EPSS 1.64%Fix available

    ImageMagick - Command Injection via SVG Decoder

    ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

    graphicsmagickOperating systems
    • Update to 1.4+really1.3.49-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2025-55154

    High · CVSS 8.8EPSS 0.95%Fix available

    ImageMagick: integer overflows in MNG magnification

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.

    graphicsmagickOperating systems
    • Update to 1.4+really1.3.49-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2014-1947

    High · CVSS 7.8EPSS 7.02%Public exploitFix available

    CVE-2014-1947

    Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.

    graphicsmagickOperating systems
    • Update to 1.3.20-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2019-11506

    High · CVSS 8.8EPSS 2.56%Fix available

    CVE-2019-11506

    In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to ExportRedQuantumType in magick/export.c.

    graphicsmagickOperating systems
    • Update to 1.4~hg15968-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →