CVE Vulnerability Catalog

ImageMagick before 6.9.13-57 and 7.1.2-32 contains a type confusion flaw in the INFO, JSON, and YAML encoders when writing compressed images, causing an unexpected pointer type. An attacker can trigger a process crash via SIGABRT or SIGSEGV, leading to denial of service.

ImageMagick 7.1.0-20 before 7.1.2-32 has a use-after-free vulnerability in the -fx option when memory allocation fails during a specific operation. Attackers supplying crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.

ImageMagick before 6.9.13-57 and 7.1.2-32 lacks proper synchronization when accessing the security policy, leading to a race condition between concurrent reads and writes by multiple threads, causing a heap buffer over-write. An attacker inducing concurrent security policy access can crash the application, causing denial of service.

ImageMagick before 6.9.13-57 and 7.1.2-32 has a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger this operation under resource-constrained conditions to leak memory and degrade service availability.

ImageMagick before 7.1.2-32 has a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use -script to close file descriptors not opened by the current operation, circumventing security policies.

ImageMagick before 7.1.2-32 has a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files blocked by the policy.

ImageMagick 7.1.1-31 before 7.1.2-32 has a NULL pointer dereference in the PostScript decoder triggered when a policy limit is reached. Attackers can supply a crafted PostScript file to crash the application, causing denial of service.

ImageMagick 7.1.2-30 before 7.1.2-32 has a use-after-free vulnerability in the WBINFO decoder when memory allocation fails during image decoding. Attackers can supply a crafted image that, under memory allocation failure, causes freed memory to be reused, crashing the application.

ImageMagick before 7.1.2-32 has a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Repeated invocation of -process with crafted arguments can gradually exhaust memory and degrade service availability.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use-after-free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. A crafted CMYK image can cause freed memory to be reused, potentially crashing the process.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker controlling a file name processed by ImageMagick can trigger a stack overflow and crash the process.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Crafted input can trigger the failing operation, leaking memory and potentially exhausting resources.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Crafted images can leak memory with each conversion attempt.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Repeated failed PNG encoding operations can exhaust memory.

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. This can lead to memory corruption and application crashes.

FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file instead of the expected remote file.

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel. A malicious server can send a Geometry CLEAR message that nulls presentation->geometry, then send VideoData that dereferences it, crashing the client.

FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer. A malicious RDP server can send unvalidated OutputBufferSize values, triggering an assertion in libusb_udev_isoch_transfer and terminating the client.

A vulnerability was identified in Netcore NR268 1.7.121109 in the eval function of /router/l7_call_board_user_set.cgi in the Web UI component. Manipulation of the title/note/URL/content arguments leads to cross-site scripting (XSS). The attack can be launched remotely and the exploit is publicly available.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it. hex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size. This issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0.