Loading story…
Multiple ImageMagick vulnerabilities were disclosed affecting common image-processing deployments (web apps, CMS integrations, and automated pipelines). CVE-2026-25794 is a heap-based buffer overflow triggered when writing UHDR images: WriteUHDRImage (coders/uhdr.c) uses 32-bit int arithmetic to compute pixel buffer size, allowing a signed integer overflow on large dimensions that leads to an undersized heap allocation and out-of-bounds write; ImageMagick 7.1.2-15 includes a patch. Separately, Belgium’s CCB warned that CVE-2026-23876 is a high-severity heap buffer overflow in the XBM decoder (ReadXBMImage) that can be triggered by a crafted image and may enable memory corruption and potential code execution; the advisory notes a public PoC and urges immediate patching.
A second ImageMagick issue, CVE-2026-25965, allows a policy bypass via path traversal because the path security policy is applied to the raw filename string before filesystem normalization; attackers can use traversal to read sensitive files (local file disclosure) even when policy-secure.xml is in place. Fixes were reported in ImageMagick 7.1.2-15 and 6.9.13-40, and guidance indicates policy hardening may be required to ensure write operations are also blocked. A separate disclosure for Traccar stored XSS via malicious SVG upload is unrelated to the ImageMagick issues and should be tracked independently.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Public advisories described CVE-2026-25794, a heap buffer overflow in WriteUHDRImage, and CVE-2026-25965, a path traversal-based policy bypass that could expose restricted files. Both disclosures identified affected versions and available fixes.
The CVE-2026-25965 advisory was received by security-advisories@github.com, documenting the ImageMagick path traversal issue and its impact on policy enforcement. This marks the formal intake of the vulnerability report referenced by the CVE entry.
ImageMagick fixed CVE-2026-25794, a heap buffer overflow in WriteUHDRImage caused by signed integer overflow when handling large UHDR image dimensions. The flaw could crash the process and potentially enable out-of-bounds heap writes with security impact.
ImageMagick addressed a path traversal flaw that could bypass policy-secure.xml protections and allow local file disclosure by normalizing or otherwise blocking restricted file access. The fix was included in versions 7.1.2-15 and 6.9.13-40, with notes that additional default policy hardening for write protections would follow.
Belgium's Centre for Cybersecurity issued a warning that the ImageMagick heap buffer overflow could be exploited to corrupt memory and potentially compromise affected systems. The advisory noted that proof-of-concept exploit code was available and urged immediate patching.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceccb.belgium.be
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT issued two advisories on **multiple vulnerabilities in ImageMagick**, the widely used image processing suite, indicating ongoing security issues affecting the software. The advisories, `2026-0474` and `2026-0633`, both identify ImageMagick as the impacted product but do not provide public synopses, suggesting organizations should review the vendor and downstream security guidance directly for affected versions and technical details. Because ImageMagick is commonly embedded in web applications, content management systems, and backend media-processing pipelines, unpatched flaws can create risk across a broad range of environments. Security teams should inventory systems and applications that rely on ImageMagick, monitor for updated package releases and distribution-specific patches, and prioritize remediation to reduce exposure from potential image parsing and processing attacks.
Jun 29, 2026
A high-severity heap buffer overflow in **ImageMagick**’s XBM image decoder (`coders/xbm.c`, `ReadXBMImage`) can be triggered by processing a specially crafted **XBM** file, including through common image upload/processing workflows. The flaw stems from **integer truncation** where `image->rows` (a 64-bit `size_t`) is cast to a 32-bit `unsigned int` for allocation, but subsequent write operations iterate using the original (non-truncated) `image->rows` value, creating a mismatch that can lead to memory corruption or crashes when attacker-supplied dimensions are large. Reporting indicates the overflow is particularly dangerous because attackers can influence both the **overflow size** (via image dimensions such as rows/columns) and the **data written** (via hex values embedded in the XBM content), enabling attacker-controlled bytes to be written past the heap buffer. The issue affects ImageMagick versions **prior to 7.1.2-13 and 6.9.13-38** and is fixed in **7.1.2-13** and **6.9.13-38**; the CVE record lists a high-impact CVSS vector `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` and maps the weakness to **CWE-190** and **CWE-122**, with upstream references including the vendor advisory and patch commit.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **MolotovCherry Android-ImageMagick7**, affecting releases prior to `7.1.2-10` and `7.1.2-11`. **CVE-2026-33854** is an out-of-bounds write flaw classified as `CWE-787`, which can lead to memory corruption and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. **CVE-2026-4755** is an improper input validation issue classified as `CWE-20`, affecting versions before `7.1.2-11` with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. The disclosures indicate both flaws could have severe impact on confidentiality, integrity, and availability, with the input validation bug standing out because it is network-exploitable and requires no privileges or user interaction. References added to the CVE records point to GitHub pull requests, including **PR #193**, suggesting fixes or remediation work is available upstream. Organizations using Android-ImageMagick7 should identify exposed deployments and prioritize upgrades to patched versions.
Jun 29, 2026