CVE-2021-3596

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	ImageMagick	ImageMagick 7.0.10-31

References

https://bugzilla.redhat.com/show_bug.cgi?id=1970569Issue Tracking, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/2624Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00018.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
https://bugzilla.redhat.com/show_bug.cgi?id=1970569Issue Tracking, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/2624Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00018.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html

Timeline

Published: Feb 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-359619.8Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attack CVE-2021-359627.5Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote CVE-2021-359639.8The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthe CVE-2021-359649.8The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execu CVE-2021-359659.8The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the web CVE-2021-359666.1The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redi CVE-2021-359675.3The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the s CVE-2021-359684.3The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers ca CVE-2021-359697.5Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.CVE-2021-35975.9A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of servi CVE-2021-359707.5Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permi CVE-2021-359719.8Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft