Loading story…
German government advisories warned of security flaws in two widely used image-processing applications, with GIMP affected by a vulnerability that could allow code execution and ImageMagick affected by a separate flaw that could enable an unspecified attack. The notices identify both products as requiring security review because they are commonly used to open, convert, and manipulate untrusted image files in desktop and server-side workflows.
The GIMP issue presents the more severe risk because successful exploitation could let an attacker run code on a target system, while the ImageMagick issue may expose systems that rely on automated image handling to further compromise depending on deployment context. Organizations using either tool in user workstations, content pipelines, or backend processing environments should verify affected versions, apply vendor fixes or distribution updates, and restrict processing of untrusted files until remediation is complete.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
dCERT published Advisory 2026-1117 for GIMP, indicating multiple vulnerabilities. The reference provides no additional technical details or remediation information.
dCERT published Advisory 2025-2669 for GIMP, warning that multiple vulnerabilities could allow code execution. The reference provides no additional technical details or remediation information.
dCERT published Advisory 2026-0784 for GIMP, warning that multiple vulnerabilities could allow code execution. The reference provides no additional technical details or remediation information.
dCERT published Advisory 2026-0702 for ImageMagick, stating that the vulnerability could allow an unspecified attack. No further technical details are included in the reference.
dCERT published Advisory 2026-0276 for GIMP, stating that the vulnerability could allow code execution. No additional technical details or remediation information are provided in the reference.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT issued two advisories on **multiple vulnerabilities in ImageMagick**, the widely used image processing suite, indicating ongoing security issues affecting the software. The advisories, `2026-0474` and `2026-0633`, both identify ImageMagick as the impacted product but do not provide public synopses, suggesting organizations should review the vendor and downstream security guidance directly for affected versions and technical details. Because ImageMagick is commonly embedded in web applications, content management systems, and backend media-processing pipelines, unpatched flaws can create risk across a broad range of environments. Security teams should inventory systems and applications that rely on ImageMagick, monitor for updated package releases and distribution-specific patches, and prioritize remediation to reduce exposure from potential image parsing and processing attacks.
Jun 29, 2026
Multiple **ImageMagick** vulnerabilities were disclosed affecting common image-processing deployments (web apps, CMS integrations, and automated pipelines). **CVE-2026-25794** is a heap-based buffer overflow triggered when writing UHDR images: `WriteUHDRImage` (`coders/uhdr.c`) uses 32-bit `int` arithmetic to compute pixel buffer size, allowing a signed integer overflow on large dimensions that leads to an undersized heap allocation and out-of-bounds write; ImageMagick **7.1.2-15** includes a patch. Separately, Belgium’s CCB warned that **CVE-2026-23876** is a high-severity heap buffer overflow in the XBM decoder (`ReadXBMImage`) that can be triggered by a crafted image and may enable memory corruption and potential code execution; the advisory notes a **public PoC** and urges immediate patching. A second ImageMagick issue, **CVE-2026-25965**, allows a **policy bypass via path traversal** because the path security policy is applied to the raw filename string before filesystem normalization; attackers can use traversal to read sensitive files (local file disclosure) even when `policy-secure.xml` is in place. Fixes were reported in **ImageMagick 7.1.2-15** and **6.9.13-40**, and guidance indicates policy hardening may be required to ensure write operations are also blocked. A separate disclosure for **Traccar** stored XSS via malicious SVG upload is unrelated to the ImageMagick issues and should be tracked independently.
Jun 29, 2026
Debian published two separate security advisories for **ImageMagick**, identified as `DSA-6210-1` and `DSA-6240-1`, indicating repeated security fixes for the widely used image processing suite across supported Debian releases. The advisories were released through Debian's security announcement channel and point to vulnerabilities significant enough to require formal package updates. ImageMagick is commonly embedded in web applications, content management systems, and backend media-processing workflows, making security flaws in the package relevant to servers that automatically handle untrusted image files. Organizations running Debian systems should review both advisories, identify affected releases and package versions, and ensure the latest ImageMagick updates have been applied across exposed or internet-facing workloads.
Jun 29, 2026