CVE-2026-24481

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
ImageMagick	ImageMagick	>= 7.0.0, < 7.1.2-15; < 6.9.13-40

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36Vendor Advisory

Timeline

Published: Feb 24, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-244845.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Mag CVE-2026-244857.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, whe CVE-2026-244867.5Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-d CVE-2026-244876.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authoriz CVE-2026-244886.5OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0 CVE-2026-244895.3Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to vers CVE-2026-24499.0Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in upKeeper Solutions upKeeper Instant Priv CVE-2026-244904.8MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF CVE-2026-244917.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the contro CVE-2026-244949.8SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticat CVE-2026-244979.8Stack-based Buffer Overflow vulnerability in SimTech Systems, Inc. ThinkWise allows Remote Code Inclusion.This issue affects ThinkWise: from CVE-2026-244987.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in EFM-Networks, Inc. IpTIME T5008, EFM-Networks, Inc. IpTIME AX200