ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

ImageMagick

0 mentions in 7 days · 1 in 30 days · 2 total · first seen · last

Search everything

Timeline

USN-8739-1: ImageMagick vulnerabilities

Canonical released USN-8739-1 fixing five ImageMagick flaws that could cause denial of service or arbitrary code execution.

Ubuntu security notice USN-8739-1 patches five ImageMagick vulnerabilities: CVE-2026-56366, CVE-2026-56368, CVE-2026-56371, and CVE-2026-56373 allow denial of service via crafted images on Ubuntu 14.04 through 22.04 LTS. CVE-2026-56370 affects Ubuntu 22.04 LTS and 26.04 LTS and could allow denial of service or arbitrary code execution. Users should apply the updated ImageMagick packages to affected releases.

Ubuntu Security Notices · 8d agoAdvisoryCVE-2026-56366CVE-2026-56368CVE-2026-56370+2 CVEs

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

WordPress 7.0.4 patches an author-level RCE in how uploaded media is handed to ImageMagick.

WordPress maintenance release 7.0.4 includes a security fix that changes how uploaded media is passed to ImageMagick, closing a path that let a logged-in author turn a crafted image upload into remote code execution. Patchstack's analysis explains the flaw as a file-type handling issue where a PNG may not be treated as a PNG. The text does not mention a CVE ID or observed exploitation, but the flaw affects extremely widely deployed software.

Patchstack · Aug 12, 2026Vulnerability

Related CVEs

  • CVE-2026-563716.9<1%
    ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes:
    ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed.
    · imagemagick imagemagick—
  • CVE-2026-563736.3<1%
    ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails.
    ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.
    · imagemagick imagemagick—
  • CVE-2026-563686.3<1%
    ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed.
    ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.
    · imagemagick imagemagick—
  • CVE-2026-563704.8<1%
    ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with inv
    ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution.
    · imagemagick imagemagick—
  • CVE-2026-563664.8<1%
    ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths.
    ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.
    · imagemagick imagemagick—

Appears with

organization Ubuntu 1product Ubuntu 1product WordPress 1vendor Canonical 1vendor ImageMagick 1vendor Patchstack 1vendor WordPress 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.