NIXPKGS-2026-1105

GitHub issue published 5 months ago

Permalink CVE-2026-33900

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  3 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9 x_refsource_CONFIRM
• https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d x_refsource_MISC

Ignored references (2)

• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 x_refsource_MISC
• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 6.9.13-44
• ==< 7.1.2-19

Very low impact, we do not have 32 bits system in tier 1 and 2 targets.

NIXPKGS-2026-1104

GitHub issue published 5 months ago

Permalink CVE-2026-40169

6.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  3 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encoders

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5592-p365-24xh x_refsource_CONFIRM
• https://github.com/ImageMagick/ImageMagick/commit/f86452a8aea37bf2b4bd36127f836dcc5f138b38 x_refsource_MISC

Ignored references (2)

• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 x_refsource_MISC
• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 7.1.2-19

NIXPKGS-2026-1103

GitHub issue published 5 months ago

Permalink CVE-2026-34238

5.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  3 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit builds

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-26qp-ffjh-2x4v x_refsource_CONFIRM
• https://github.com/ImageMagick/ImageMagick/commit/bcd8519c70ecd9ebbc180920f2cf97b267d1f440 x_refsource_MISC

Ignored references (2)

• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 x_refsource_MISC
• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 6.9.13-44
• ==< 7.1.2-19

NIXPKGS-2026-1102

GitHub issue published 5 months ago

Permalink CVE-2026-33905

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  3 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick has an Out-of-Bounds read via -sample operation

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pcvx-ph33-r5vv x_refsource_CONFIRM
• https://github.com/ImageMagick/ImageMagick/commit/cca607366fb38c2dde019a9088b8415ffba3a835 x_refsource_MISC

Ignored references (2)

• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 x_refsource_MISC
• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 6.9.13-44
• ==< 7.1.2-19

NIXPKGS-2026-1101

GitHub issue published 5 months ago

Permalink CVE-2026-40183

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  6 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  • imagemagick6
  • imagemagick6Big
  • imagemagick6_light
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit float

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jvgr-9ph5-m8v4 x_refsource_CONFIRM

Ignored references (2)

• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 x_refsource_MISC
• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 7.1.2-19

NIXPKGS-2026-1100

GitHub issue published 5 months ago

Permalink CVE-2026-33908

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  3 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x x_refsource_CONFIRM
• https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8 x_refsource_MISC

Ignored references (2)

• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 x_refsource_MISC
• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 6.9.13-44
• ==< 7.1.2-19

NIXPKGS-2026-1099

GitHub issue published 5 months ago

Permalink CVE-2026-40311

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  3 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing values

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r83h-crwp-3vm7 x_refsource_CONFIRM
• https://github.com/ImageMagick/ImageMagick/commit/5facfecf1abb3fed46a08f614dcc43d1e548e20d x_refsource_MISC

Ignored references (2)

• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 x_refsource_MISC
• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 6.9.13-44
• ==< 7.1.2-19

NIXPKGS-2026-1097

GitHub issue published 5 months ago

Permalink CVE-2026-33899

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  3 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick: Heap BufferOverflow write of single zero byte when parsing XML

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2 x_refsource_CONFIRM
• https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d x_refsource_MISC

Ignored references (2)

• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 x_refsource_MISC
• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 6.9.13-44
• ==< 7.1.2-19

NIXPKGS-2026-1098

GitHub issue published 5 months ago

Permalink CVE-2026-40312

6.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  6 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  • imagemagick6Big
  • imagemagick_light
  • imagemagick6_light
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick: Off-by-One in MSL decoder could result in crash

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5xg3-585r-9jh5 x_refsource_CONFIRM
• https://github.com/ImageMagick/ImageMagick/commit/2a06c7be3bba3326caf8b7a8d1fa2e0d4b88998d x_refsource_MISC
• https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19 x_refsource_MISC

Ignored references (1)

• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 7.1.2-19

NIXPKGS-2026-1096

GitHub issue published 5 months ago

Permalink CVE-2026-33901

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  3 packages

  • graphicsmagick-imagemagick-compat
  • tests.pkg-config.defaultPkgConfigPackages.MagickWand
  • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

ImageMagick has a Heap Buffer Overflow via MVG decoder

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww x_refsource_CONFIRM
• https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe x_refsource_MISC

Ignored references (1)

• https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0 x_refsource_MISC

---

ImageMagick

• ==< 6.9.13-44
• ==< 7.1.2-19