Nixpkgs security tracker

Untriaged

Permalink CVE-2026-45358

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 3 months ago Activity log

Created suggestion 3 months ago

ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr6r-hmj8-pr7r x_refsource_CONFIRM

Affected products

ImageMagick

==< 7.1.2-22
==< 6.9.13-47

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 -
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Untriaged

Permalink CVE-2026-46520

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 3 months ago Activity log

Created suggestion 3 months ago

ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5 x_refsource_CONFIRM

Affected products

ImageMagick

==< 6.9.13-48
==< 7.1.2-23

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 -
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Untriaged

Permalink CVE-2026-46557

6.2 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 3 months ago Activity log

Created suggestion 3 months ago

ImageMagick: Stack overflow in fx operation

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-23, due to a missing depth check a stack overflow can occur in the fx operation by passing a crafted argument. This issue has been patched in version 7.1.2-23.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rcr6-g7jc-f57g x_refsource_CONFIRM

Affected products

ImageMagick

==< 7.1.2-23

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 -
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Untriaged

Permalink CVE-2026-45664

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 3 months ago Activity log

Created suggestion 3 months ago

ImageMagick: Policy Bypass in MNG coder could

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6 x_refsource_CONFIRM

Affected products

ImageMagick

==< 7.1.2-22
==< 6.9.13-47

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 -
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Untriaged

Permalink CVE-2026-32636

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 5 months, 3 weeks ago Activity log

Created suggestion 5 months, 3 weeks ago

ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp x_refsource_CONFIRM
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17 x_refsource_MISC
https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0 x_refsource_MISC

Affected products

ImageMagick

==< 6.9.13-42
==< 7.1.2-17

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-13
- nixpkgs-unstable 7.1.2-13
- nixos-unstable-small 7.1.2-13

pkgs.imagemagick6

None

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-13
- nixpkgs-unstable 7.1.2-13
- nixos-unstable-small 7.1.2-13

pkgs.imagemagick6Big

None

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-13
- nixpkgs-unstable 7.1.2-13
- nixos-unstable-small 7.1.2-13

pkgs.imagemagick6_light

None

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.46
- nixpkgs-unstable 1.3.46
- nixos-unstable-small 1.3.46

pkgs.tests.pkg-config.defaultPkgConfigPackages.MagickWand

Test whether imagemagick-7.1.2-3 exposes pkg-config modules ImageMagick

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small

pkgs.tests.pkg-config.defaultPkgConfigPackages.ImageMagick

Test whether imagemagick-7.1.2-3 exposes pkg-config modules ImageMagick

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small

Package maintainers

@Ambossmann Timo Gottszky <timogottszky+git@gmail.com>
@rhendric Ryan Hendrickson
@faukah faukah
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>

Published

Permalink CVE-2026-25983

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 2 weeks ago
@LeSuisse published on GitHub 6 months, 2 weeks ago

ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566 x_refsource_CONFIRM

Affected products

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-12
- nixpkgs-unstable 7.1.2-12
- nixos-unstable-small 7.1.2-13

pkgs.imagemagick6

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 6.9.13-38
- nixpkgs-unstable 6.9.13-38
- nixos-unstable-small 6.9.13-38

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-12
- nixpkgs-unstable 7.1.2-12
- nixos-unstable-small 7.1.2-13

pkgs.imagemagick6Big

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 6.9.13-38
- nixpkgs-unstable 6.9.13-38
- nixos-unstable-small 6.9.13-38

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-12
- nixpkgs-unstable 7.1.2-12
- nixos-unstable-small 7.1.2-13

pkgs.imagemagick6_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 6.9.13-38
- nixpkgs-unstable 6.9.13-38
- nixos-unstable-small 6.9.13-38

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.46
- nixpkgs-unstable 1.3.46
- nixos-unstable-small 1.3.46

pkgs.tests.pkg-config.defaultPkgConfigPackages.MagickWand

Test whether imagemagick-7.1.2-3 exposes pkg-config modules ImageMagick

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small

pkgs.tests.pkg-config.defaultPkgConfigPackages.ImageMagick

Test whether imagemagick-7.1.2-3 exposes pkg-config modules ImageMagick

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small

Package maintainers

@Ambossmann Timo Gottszky <timogottszky+git@gmail.com>

Ignored maintainers (3)

@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
@rhendric Ryan Hendrickson
@faukah faukah

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagick6

pkgs.imagemagickBig

pkgs.imagemagick6Big

pkgs.imagemagick_light

pkgs.imagemagick6_light

pkgs.graphicsmagick-imagemagick-compat

pkgs.tests.pkg-config.defaultPkgConfigPackages.MagickWand

pkgs.tests.pkg-config.defaultPkgConfigPackages.ImageMagick

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagick6

pkgs.imagemagickBig

pkgs.imagemagick6Big

pkgs.imagemagick_light

pkgs.imagemagick6_light

pkgs.graphicsmagick-imagemagick-compat

pkgs.tests.pkg-config.defaultPkgConfigPackages.MagickWand

pkgs.tests.pkg-config.defaultPkgConfigPackages.ImageMagick

Package maintainers