Nixpkgs security tracker

Untriaged

Permalink CVE-2026-46520

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 3 months ago Activity log

Created suggestion 3 months ago

ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5 x_refsource_CONFIRM

Affected products

ImageMagick

==< 6.9.13-48
==< 7.1.2-23

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 -
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Untriaged

Permalink CVE-2026-46557

6.2 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 3 months ago Activity log

Created suggestion 3 months ago

ImageMagick: Stack overflow in fx operation

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-23, due to a missing depth check a stack overflow can occur in the fx operation by passing a crafted argument. This issue has been patched in version 7.1.2-23.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rcr6-g7jc-f57g x_refsource_CONFIRM

Affected products

ImageMagick

==< 7.1.2-23

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 -
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Untriaged

Permalink CVE-2026-45664

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 3 months ago Activity log

Created suggestion 3 months ago

ImageMagick: Policy Bypass in MNG coder could

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6 x_refsource_CONFIRM

Affected products

ImageMagick

==< 7.1.2-22
==< 6.9.13-47

Matching in nixpkgs

pkgs.imagemagick

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagickBig

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.imagemagick_light

Software suite to create, edit, compose, or convert bitmap images

nixos-unstable 7.1.2-23
- nixpkgs-unstable 7.1.2-23
- nixos-unstable-small 7.1.2-23
nixos-26.05 -
- nixos-26.05-small 7.1.2-23
- nixpkgs-26.05-darwin 7.1.2-23

pkgs.haskellPackages.ihp-imagemagick

ImageMagick preprocessing for IHP file uploads

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.graphicsmagick-imagemagick-compat

Repack of GraphicsMagick that provides compatibility with ImageMagick interfaces

nixos-unstable 1.3.47
- nixpkgs-unstable 1.3.47
- nixos-unstable-small 1.3.47
nixos-26.05 -
- nixos-26.05-small 1.3.47
- nixpkgs-26.05-darwin 1.3.47

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat

References

Affected products

Matching in nixpkgs

pkgs.imagemagick

pkgs.imagemagickBig

pkgs.imagemagick_light

pkgs.haskellPackages.ihp-imagemagick

pkgs.graphicsmagick-imagemagick-compat