CVE-2026-106577

Published: Oct 7, 2026Modified: Oct 21, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Affected (2)

Products: Imagemagick: Imagemagick

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Imagemagick Imagemagick	version < 6.9.13-56
Imagemagick Imagemagick	7.0.0-0 ≤ version < 7.1.2-31

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (7)

https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192

Source: security-advisories@github.com

Patch

https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8

Source: security-advisories@github.com

Patch

https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31

Source: security-advisories@github.com

PatchRelease Notes

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892

Source: security-advisories@github.com

Vendor Advisory

https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53

Source: security-advisories@github.com

Patch

https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484

Source: security-advisories@github.com

Patch

https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56

Source: security-advisories@github.com

PatchRelease Notes

Timeline

No history available yet.