PT-2026-57444 · Imagemagick · Imagemagick

Rexpository · Publicado 2026-07-11 · Atualizado 2026-07-11 · CVE-2026-61857

NVD

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

Correção

Unchecked Return Value

Enumeração de Fraquezas

CWE-252

Identificadores relacionados

CVE-2026-61857

Produtos afetados

Imagemagick

Referências · 3

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh5g-q395-cx4j · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-61857 · Nota de Segurança
• https://vulncheck.com/advisories/imagemagick-before-26-heap-use-after-free-via-xmp · Nota