Nixpkgs security tracker

Untriaged

Permalink CVE-2026-46523

6.2 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 9 hours ago Activity log

Created suggestion 9 hours ago

ImageMagick: Use-After-Free in MSL decoder.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q x_refsource_CONFIRM

Affected products

ImageMagick

==< 7.1.2-23
==< 6.9.13-48

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 1.3.47
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Package maintainers

@Ambossmann Timo Gottszky <timogottszky+git@gmail.com>
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
@faukah faukah
@rhendric Ryan Hendrickson

Untriaged

Permalink CVE-2026-46692

4.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 9 hours ago Activity log

Created suggestion 9 hours ago

ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p93h-f2jc-477j x_refsource_CONFIRM

Affected products

ImageMagick

==< 7.1.2-23
==< 6.9.13-48

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 1.3.47
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Package maintainers

@Ambossmann Timo Gottszky <timogottszky+git@gmail.com>
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
@faukah faukah
@rhendric Ryan Hendrickson

Untriaged

Permalink CVE-2026-45358

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 9 hours ago Activity log

Created suggestion 9 hours ago

ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr6r-hmj8-pr7r x_refsource_CONFIRM

Affected products

ImageMagick

==< 6.9.13-47
==< 7.1.2-22

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 1.3.47
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Package maintainers

@Ambossmann Timo Gottszky <timogottszky+git@gmail.com>
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
@faukah faukah
@rhendric Ryan Hendrickson

Untriaged

Permalink CVE-2026-46520

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 9 hours ago Activity log

Created suggestion 9 hours ago

ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5 x_refsource_CONFIRM

Affected products

ImageMagick

==< 7.1.2-23
==< 6.9.13-48

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 1.3.47
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Package maintainers

@Ambossmann Timo Gottszky <timogottszky+git@gmail.com>
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
@faukah faukah
@rhendric Ryan Hendrickson

Untriaged

Permalink CVE-2026-46557

6.2 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 9 hours ago Activity log

Created suggestion 9 hours ago

ImageMagick: Stack overflow in fx operation

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-23, due to a missing depth check a stack overflow can occur in the fx operation by passing a crafted argument. This issue has been patched in version 7.1.2-23.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rcr6-g7jc-f57g x_refsource_CONFIRM

Affected products

ImageMagick

==< 7.1.2-23

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 1.3.47
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Package maintainers

@Ambossmann Timo Gottszky <timogottszky+git@gmail.com>
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
@faukah faukah
@rhendric Ryan Hendrickson

Untriaged

Permalink CVE-2026-45664

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 9 hours ago Activity log

Created suggestion 9 hours ago

ImageMagick: Policy Bypass in MNG coder could

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6 x_refsource_CONFIRM

Affected products

ImageMagick

==< 6.9.13-47
==< 7.1.2-22

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 7.1.2-23
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 1.3.47
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Package maintainers

@Ambossmann Timo Gottszky <timogottszky+git@gmail.com>
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
@faukah faukah
@rhendric Ryan Hendrickson

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

Package maintainers