MEDIUM
ImageMagick: Heap Buffer Over-Write in fx operation
Published Jul 30, 2026
5.0
MEDIUMCVSS 3.1
EPSS 0.13%
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27.
Affected products
-
- Version < 7.1.2-27StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ImageMagick | ImageMagick | n/a |
|
- < 7.1.2-27
No data.
Red Hat Enterprise Linux 6
ImageMagick
Out of support scope
Red Hat Enterprise Linux 7
ImageMagick
Out of support scope
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | ImageMagick | Out of support scope | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (8)
- https://access.redhat.com/security/cve/CVE-2026-62363 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2508731 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50573 Advisory
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-422r-8c97-xcg4 x_refsource_CONFIRMVendor Advisory
- https://github.com/advisories/GHSA-422r-8c97-xcg4 Advisory
- https://github.com/dlemstra/Magick.NET/releases/tag/14.15.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-62363
- https://www.cve.org/CVERecord?id=CVE-2026-62363
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Jul 30, 2026
Updated Jul 30, 2026
Reserved Jul 13, 2026
Link CVE-2026-62363
CISA Vulnrichment
Updated Jul 30, 2026
ENISA EUVD
EUVD-2026-50573 GHSA-422R-8C97-XCG4 Assigner GitHub_M
Published Jul 30, 2026
Updated Jul 30, 2026
Exploited since n/a
Link EUVD-2026-50573