{"grype_matches":[{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"risk":2.3245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"risk":2.3245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"risk":2.3245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"risk":2.3245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"risk":2.3245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-20","epss":0.04649,"percentile":0.91642}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"risk":0.967,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"risk":0.967,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"risk":0.967,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"risk":0.967,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"risk":0.967,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-20","epss":0.01934,"percentile":0.79774}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-20","epss":0.01643,"percentile":0.7609}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-10126","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-20","epss":0.01829,"percentile":0.78558}],"risk":0.5487,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-10126"},"relatedVulnerabilities":[{"id":"CVE-2018-10126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-20","epss":0.01829,"percentile":0.78558}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2786","https://gitlab.com/libtiff/libtiff/-/issues/128","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-20","epss":0.01824,"percentile":0.78502}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-20","epss":0.01824,"percentile":0.78502}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-6988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-20","epss":0.01724,"percentile":0.77199}],"risk":0.5172,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6988"},"relatedVulnerabilities":[{"id":"CVE-2019-6988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-20","epss":0.01724,"percentile":0.77199}],"urls":["http://www.securityfocus.com/bid/106785","https://github.com/uclouvain/openjpeg/issues/1178"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"risk":0.47850000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"risk":0.47850000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"risk":0.47850000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"risk":0.47850000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"risk":0.47850000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-20","epss":0.00957,"percentile":0.60847}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-20","epss":0.0095,"percentile":0.60634}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-20","epss":0.00945,"percentile":0.60491}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-7156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-7156","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-7156","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-7156","date":"2026-10-20","epss":0.01557,"percentile":0.74846}],"risk":0.46709999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-7156"},"relatedVulnerabilities":[{"id":"CVE-2019-7156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-7156","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-7156","date":"2026-10-20","epss":0.01557,"percentile":0.74846}],"urls":["http://www.securityfocus.com/bid/106813","https://github.com/uvoteam/libdoc/issues/5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-7156","description":"In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-20","epss":0.0148,"percentile":0.73558}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-20","epss":0.0148,"percentile":0.73558}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-7233","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-7233","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-7233","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-7233","date":"2026-10-20","epss":0.01473,"percentile":0.73446}],"risk":0.4419,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-7233"},"relatedVulnerabilities":[{"id":"CVE-2019-7233","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-7233","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-7233","date":"2026-10-20","epss":0.01473,"percentile":0.73446}],"urls":["https://github.com/uvoteam/libdoc/issues/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-7233","description":"In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"risk":0.4365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"risk":0.4365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"risk":0.4365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"risk":0.4365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"risk":0.4365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-20","epss":0.00873,"percentile":0.58252}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-20","epss":0.00809,"percentile":0.5619}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"risk":0.4035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"risk":0.4035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"risk":0.4035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"risk":0.4035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"risk":0.4035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-20","epss":0.00807,"percentile":0.56126}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-20","epss":0.0074,"percentile":0.53819}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-20","epss":0.00735,"percentile":0.53665}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-20","epss":0.00719,"percentile":0.5308}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"risk":0.3535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"risk":0.3535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"risk":0.3535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"risk":0.3535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"risk":0.3535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-20","epss":0.00707,"percentile":0.52637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"risk":0.35000000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"risk":0.35000000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"risk":0.35000000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"risk":0.35000000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"risk":0.35000000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-20","epss":0.007,"percentile":0.5235}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-20","epss":0.00678,"percentile":0.51474}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-20","epss":0.00676,"percentile":0.51412}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"risk":0.327,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"risk":0.327,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"risk":0.327,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"risk":0.327,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"risk":0.327,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-20","epss":0.00654,"percentile":0.5044}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-20","epss":0.00647,"percentile":0.5009}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"risk":0.3165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"risk":0.3165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"risk":0.3165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"risk":0.3165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"risk":0.3165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-20","epss":0.00633,"percentile":0.49411}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-20","epss":0.0063,"percentile":0.49252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"5d668b4eb9cdb47a","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-20","epss":0.0063,"percentile":0.4925}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-20","epss":0.0063,"percentile":0.4925}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"bc00ecb2bdfc2b6f","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-20","epss":0.0063,"percentile":0.4925}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-20","epss":0.0063,"percentile":0.4925}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"bdd817d23e512645","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-20","epss":0.0063,"percentile":0.4925}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-20","epss":0.0063,"percentile":0.4925}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"c9080c1b63d1cc8f","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.6?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-20","epss":0.0063,"percentile":0.4925}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-20","epss":0.0063,"percentile":0.4925}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-20","epss":0.0063,"percentile":0.49249}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-20","epss":0.0063,"percentile":0.49248}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-20","epss":0.0063,"percentile":0.49244}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-20","epss":0.00601,"percentile":0.47809}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"risk":0.3,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"risk":0.3,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"risk":0.3,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"risk":0.3,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"risk":0.3,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-20","epss":0.006,"percentile":0.47767}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"risk":0.295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"risk":0.295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"risk":0.295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"risk":0.295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"risk":0.295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-20","epss":0.0059,"percentile":0.47252}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-39329","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-20","epss":0.00588,"percentile":0.47143}],"risk":0.294,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-39329"},"relatedVulnerabilities":[{"id":"CVE-2023-39329","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-20","epss":0.00588,"percentile":0.47143}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39329","https://bugzilla.redhat.com/show_bug.cgi?id=2295816","https://github.com/uclouvain/openjpeg/issues/1474"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."}]},{"artifact":{"id":"12838fd0d4234cbd","cpes":["cpe:2.3:a:libpixman-1-0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1-0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*"],"name":"libpixman-1-0","purl":"pkg:deb/ubuntu/libpixman-1-0@0.42.2-1build1?arch=amd64&distro=ubuntu-24.04&upstream=pixman","type":"deb","version":"0.42.2-1build1","language":"","licenses":["sha256:1b3fb5690861e15ca4fd6640fd4def4b2576617942eec04b6fcb7d8bc6c4c9da"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpixman-1-0/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libpixman-1-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pixman"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-37769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pixman","version":"0.42.2-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-37769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-20","epss":0.00586,"percentile":0.47046}],"risk":0.293,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-37769"},"relatedVulnerabilities":[{"id":"CVE-2023-37769","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-20","epss":0.00586,"percentile":0.47046}],"urls":["https://gitlab.freedesktop.org/pixman/pixman/-/issues/76"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37769","description":"stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"risk":0.2915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"risk":0.2915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"risk":0.2915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"risk":0.2915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"risk":0.2915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-20","epss":0.00583,"percentile":0.46863}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-20","epss":0.00577,"percentile":0.46495}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-46345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-46345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-46345","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-46345","date":"2026-10-20","epss":0.00576,"percentile":0.46475}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-46345"},"relatedVulnerabilities":[{"id":"CVE-2023-46345","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-46345","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-46345","date":"2026-10-20","epss":0.00576,"percentile":0.46475}],"urls":["https://gist.github.com/rycbar77/d747b2c37b544ece30b2353a65ab41f9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-46345","description":"Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c."}]},{"artifact":{"id":"44cffe49b484d7fa","cpes":["cpe:2.3:a:unrtf:unrtf:0.21.10-clean-1:*:*:*:*:*:*:*"],"name":"unrtf","purl":"pkg:deb/ubuntu/unrtf@0.21.10-clean-1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.21.10-clean-1","language":"","licenses":["sha256:da496fdffef01c170e100d6b2d68fe7ef0b85a6d9e34eb6180d205d74bdde350"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/unrtf/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/unrtf/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/unrtf.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/unrtf.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/unrtf.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/unrtf.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-65411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"unrtf","version":"0.21.10-clean-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-65411","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-65411","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-65411","date":"2026-10-20","epss":0.00568,"percentile":0.46018}],"risk":0.28400000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-65411"},"relatedVulnerabilities":[{"id":"CVE-2025-65411","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-65411","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-65411","date":"2026-10-20","epss":0.00568,"percentile":0.46018}],"urls":["https://github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65411.md","https://lists.gnu.org/archive/html/bug-unrtf/2025-11/msg00000.html","https://savannah.gnu.org/projects/unrtf/","https://sources.debian.org/src/unrtf/0.21.10-clean-1/src/main.c/#L661","https://www.gnu.org/software/unrtf/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-65411","description":"A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-20453","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-20453","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20453","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20453","date":"2026-10-20","epss":0.00944,"percentile":0.60455}],"risk":0.2832,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20453"},"relatedVulnerabilities":[{"id":"CVE-2018-20453","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20453","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20453","date":"2026-10-20","epss":0.00944,"percentile":0.60455}],"urls":["https://github.com/uvoteam/libdoc/issues/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20453","description":"The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"risk":0.28200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"risk":0.28200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"risk":0.28200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"risk":0.28200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"risk":0.28200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-20","epss":0.00564,"percentile":0.45829}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"47ce4978ec8c6003","cpes":["cpe:2.3:a:libpoppler134:libpoppler134:24.02.0-1ubuntu9.10:*:*:*:*:*:*:*"],"name":"libpoppler134","purl":"pkg:deb/ubuntu/libpoppler134@24.02.0-1ubuntu9.10?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.10","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler134/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libpoppler134/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93311","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93311","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-10-20","epss":0.00562,"percentile":0.45665}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93311"},"relatedVulnerabilities":[{"id":"CVE-2026-93311","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-10-20","epss":0.00562,"percentile":0.45665}],"urls":["https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758","https://vuldb.com/cve/CVE-2026-93311","https://vuldb.com/submit/942344","https://vuldb.com/vuln/406609","https://vuldb.com/vuln/406609/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93311","description":"A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet."}]},{"artifact":{"id":"8d5b849f88ecca5e","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:24.02.0-1ubuntu9.10:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:24.02.0-1ubuntu9.10:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:24.02.0-1ubuntu9.10:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:24.02.0-1ubuntu9.10:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:24.02.0-1ubuntu9.10:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:24.02.0-1ubuntu9.10:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/ubuntu/poppler-utils@24.02.0-1ubuntu9.10?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.10","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93311","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93311","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-10-20","epss":0.00562,"percentile":0.45665}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93311"},"relatedVulnerabilities":[{"id":"CVE-2026-93311","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-10-20","epss":0.00562,"percentile":0.45665}],"urls":["https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758","https://vuldb.com/cve/CVE-2026-93311","https://vuldb.com/submit/942344","https://vuldb.com/vuln/406609","https://vuldb.com/vuln/406609/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93311","description":"A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-20451","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-20451","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20451","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20451","date":"2026-10-20","epss":0.00936,"percentile":0.60215}],"risk":0.2808,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20451"},"relatedVulnerabilities":[{"id":"CVE-2018-20451","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20451","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20451","date":"2026-10-20","epss":0.00936,"percentile":0.60215}],"urls":["https://github.com/uvoteam/libdoc/issues/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20451","description":"The process_file function in reader.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-20","epss":0.00558,"percentile":0.45431}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-20","epss":0.00554,"percentile":0.45202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4775","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-20","epss":0.00553,"percentile":0.45153}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4775"},"relatedVulnerabilities":[{"id":"CVE-2026-4775","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-20","epss":0.00553,"percentile":0.45153}],"urls":["https://access.redhat.com/errata/RHSA-2026:12265","https://access.redhat.com/errata/RHSA-2026:12271","https://access.redhat.com/errata/RHSA-2026:14929","https://access.redhat.com/errata/RHSA-2026:16055","https://access.redhat.com/errata/RHSA-2026:19150","https://access.redhat.com/errata/RHSA-2026:19363","https://access.redhat.com/errata/RHSA-2026:19585","https://access.redhat.com/errata/RHSA-2026:19586","https://access.redhat.com/errata/RHSA-2026:19604","https://access.redhat.com/errata/RHSA-2026:19608","https://access.redhat.com/errata/RHSA-2026:19609","https://access.redhat.com/errata/RHSA-2026:19657","https://access.redhat.com/errata/RHSA-2026:19659","https://access.redhat.com/errata/RHSA-2026:19702","https://access.redhat.com/errata/RHSA-2026:20583","https://access.redhat.com/errata/RHSA-2026:20585","https://access.redhat.com/errata/RHSA-2026:20591","https://access.redhat.com/errata/RHSA-2026:20592","https://access.redhat.com/errata/RHSA-2026:24992","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25910","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30349","https://access.redhat.com/errata/RHSA-2026:33388","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-4775","https://bugzilla.redhat.com/show_bug.cgi?id=2450768","https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4775","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-20","epss":0.00549,"percentile":0.44879}],"risk":0.2745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-20","epss":0.00549,"percentile":0.44879}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-20","epss":0.00527,"percentile":0.43492}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-20","epss":0.00524,"percentile":0.43331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-20","epss":0.00524,"percentile":0.4329}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-20","epss":0.00521,"percentile":0.4308}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-20","epss":0.00521,"percentile":0.4308}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-20","epss":0.00521,"percentile":0.4308}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-20","epss":0.00521,"percentile":0.4308}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-20","epss":0.00521,"percentile":0.4308}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-20","epss":0.00521,"percentile":0.4308}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-20","epss":0.00521,"percentile":0.4308}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-20","epss":0.00521,"percentile":0.4308}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"ec7bc8c431630985","cpes":["cpe:2.3:a:libheif-plugin-aomdec:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-aomdec:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_aomdec:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_aomdec:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*"],"name":"libheif-plugin-aomdec","purl":"pkg:deb/ubuntu/libheif-plugin-aomdec@1.17.6-1ubuntu4.9?arch=amd64&distro=ubuntu-24.04&upstream=libheif","type":"deb","version":"1.17.6-1ubuntu4.9","language":"","licenses":["BOOST-1.0","BSD-3-clause","BSD-4-clause","GPL-3","GPL-3+","LGPL-3","LGPL-3+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-aomdec/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libheif-plugin-aomdec/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-aomdec:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libheif-plugin-aomdec:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libheif","version":"1.17.6-1ubuntu4.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-20","epss":0.00517,"percentile":0.4286}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84447"},"relatedVulnerabilities":[{"id":"CVE-2026-84447","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-20","epss":0.00517,"percentile":0.4286}],"urls":["https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."}]},{"artifact":{"id":"fe8b2702206cdb90","cpes":["cpe:2.3:a:libheif1:libheif1:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*"],"name":"libheif1","purl":"pkg:deb/ubuntu/libheif1@1.17.6-1ubuntu4.9?arch=amd64&distro=ubuntu-24.04&upstream=libheif","type":"deb","version":"1.17.6-1ubuntu4.9","language":"","licenses":["BOOST-1.0","BSD-3-clause","BSD-4-clause","GPL-3","GPL-3+","LGPL-3","LGPL-3+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif1/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libheif1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif1:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libheif1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libheif","version":"1.17.6-1ubuntu4.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-20","epss":0.00517,"percentile":0.4286}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84447"},"relatedVulnerabilities":[{"id":"CVE-2026-84447","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-20","epss":0.00517,"percentile":0.4286}],"urls":["https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-20","epss":0.0051,"percentile":0.42335}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-20","epss":0.00501,"percentile":0.41669}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-20","epss":0.00494,"percentile":0.41203}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25970","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25970","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25970"},"relatedVulnerabilities":[{"id":"CVE-2026-25970","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25970","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25970","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25970","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25970"},"relatedVulnerabilities":[{"id":"CVE-2026-25970","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25970","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25970","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25970","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25970"},"relatedVulnerabilities":[{"id":"CVE-2026-25970","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25970","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25970","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25970","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25970"},"relatedVulnerabilities":[{"id":"CVE-2026-25970","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25970","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25970","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25970","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25970"},"relatedVulnerabilities":[{"id":"CVE-2026-25970","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25970","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25970","date":"2026-10-20","epss":0.00494,"percentile":0.41202}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25970","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-20","epss":0.00489,"percentile":0.40815}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"risk":0.2405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"risk":0.2405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"risk":0.2405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"risk":0.2405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"risk":0.2405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-20","epss":0.00481,"percentile":0.40197}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"risk":0.23800000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25968"},"relatedVulnerabilities":[{"id":"CVE-2026-25968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25968","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"risk":0.23800000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25968"},"relatedVulnerabilities":[{"id":"CVE-2026-25968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25968","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"risk":0.23800000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25968"},"relatedVulnerabilities":[{"id":"CVE-2026-25968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25968","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"risk":0.23800000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25968"},"relatedVulnerabilities":[{"id":"CVE-2026-25968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25968","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"risk":0.23800000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25968"},"relatedVulnerabilities":[{"id":"CVE-2026-25968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25968","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25968","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25968","date":"2026-10-20","epss":0.00476,"percentile":0.39852}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3mwp-xqp2-q6ph"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25968","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-20","epss":0.00471,"percentile":0.39477}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-20","epss":0.0047,"percentile":0.39373}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-20","epss":0.00468,"percentile":0.39197}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-20","epss":0.0046,"percentile":0.38629}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-20","epss":0.00453,"percentile":0.38076}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-20","epss":0.00452,"percentile":0.38012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-20","epss":0.0044,"percentile":0.36882}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12912","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12912","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-20","epss":0.00433,"percentile":0.36245}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12912"},"relatedVulnerabilities":[{"id":"CVE-2026-12912","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-20","epss":0.00433,"percentile":0.36245}],"urls":["https://access.redhat.com/errata/RHSA-2026:34890","https://access.redhat.com/errata/RHSA-2026:41892","https://access.redhat.com/errata/RHSA-2026:42668","https://access.redhat.com/errata/RHSA-2026:47183","https://access.redhat.com/errata/RHSA-2026:47184","https://access.redhat.com/errata/RHSA-2026:49671","https://access.redhat.com/errata/RHSA-2026:50774","https://access.redhat.com/errata/RHSA-2026:54638","https://access.redhat.com/errata/RHSA-2026:54640","https://access.redhat.com/errata/RHSA-2026:54642","https://access.redhat.com/errata/RHSA-2026:58545","https://access.redhat.com/errata/RHSA-2026:58553","https://access.redhat.com/errata/RHSA-2026:58554","https://access.redhat.com/errata/RHSA-2026:58556","https://access.redhat.com/errata/RHSA-2026:61657","https://access.redhat.com/errata/RHSA-2026:69292","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:83550","https://access.redhat.com/security/cve/CVE-2026-12912","https://bugzilla.redhat.com/show_bug.cgi?id=2492871","https://gitlab.com/libtiff/libtiff/-/merge_requests/873","https://gitlab.com/libtiff/libtiff/-/work_items/824","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12912","description":"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-20","epss":0.00427,"percentile":0.35637}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-20","epss":0.00426,"percentile":0.35522}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-20","epss":0.00424,"percentile":0.35335}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-20","epss":0.00424,"percentile":0.35335}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-20","epss":0.00424,"percentile":0.35335}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-20","epss":0.00424,"percentile":0.35335}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-20","epss":0.00424,"percentile":0.35335}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-20","epss":0.00424,"percentile":0.35335}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-20","epss":0.00424,"percentile":0.35335}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-20","epss":0.00424,"percentile":0.35335}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-20","epss":0.00424,"percentile":0.35324}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-20","epss":0.00421,"percentile":0.35089}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28687","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28687","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28687"},"relatedVulnerabilities":[{"id":"CVE-2026-28687","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28687","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28687","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28687","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28687"},"relatedVulnerabilities":[{"id":"CVE-2026-28687","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28687","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28687","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28687","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28687"},"relatedVulnerabilities":[{"id":"CVE-2026-28687","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28687","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28687","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28687","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28687"},"relatedVulnerabilities":[{"id":"CVE-2026-28687","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28687","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28687","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28687","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28687"},"relatedVulnerabilities":[{"id":"CVE-2026-28687","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28687","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28687","date":"2026-10-20","epss":0.00418,"percentile":0.34742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28687","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-46523","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46523","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"risk":0.20850000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46523"},"relatedVulnerabilities":[{"id":"CVE-2026-46523","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46523","https://bugzilla.redhat.com/show_bug.cgi?id=2487743","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46523.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46523","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46523","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46523","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"risk":0.20850000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46523"},"relatedVulnerabilities":[{"id":"CVE-2026-46523","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46523","https://bugzilla.redhat.com/show_bug.cgi?id=2487743","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46523.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46523","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46523","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46523","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"risk":0.20850000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46523"},"relatedVulnerabilities":[{"id":"CVE-2026-46523","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46523","https://bugzilla.redhat.com/show_bug.cgi?id=2487743","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46523.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46523","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46523","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46523","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"risk":0.20850000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46523"},"relatedVulnerabilities":[{"id":"CVE-2026-46523","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46523","https://bugzilla.redhat.com/show_bug.cgi?id=2487743","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46523.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46523","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46523","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46523","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"risk":0.20850000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46523"},"relatedVulnerabilities":[{"id":"CVE-2026-46523","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46523","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46523","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46523","date":"2026-10-20","epss":0.00417,"percentile":0.34602}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46523","https://bugzilla.redhat.com/show_bug.cgi?id=2487743","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46523.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46523","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-20","epss":0.00414,"percentile":0.34288}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-20","epss":0.00404,"percentile":0.33262}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-20","epss":0.00404,"percentile":0.33222}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-20","epss":0.00403,"percentile":0.33174}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93990"},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-20","epss":0.00403,"percentile":0.33174}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-20","epss":0.00402,"percentile":0.33024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-20","epss":0.004,"percentile":0.32883}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-20","epss":0.00394,"percentile":0.32111}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-20","epss":0.00394,"percentile":0.32111}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-20","epss":0.00389,"percentile":0.31562}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-20","epss":0.00384,"percentile":0.31025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-20","epss":0.00384,"percentile":0.31024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-20","epss":0.00384,"percentile":0.3098}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-20","epss":0.00384,"percentile":0.30979}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25971","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25971"},"relatedVulnerabilities":[{"id":"CVE-2026-25971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25971","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25971","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25971"},"relatedVulnerabilities":[{"id":"CVE-2026-25971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25971","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25971","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25971"},"relatedVulnerabilities":[{"id":"CVE-2026-25971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25971","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25971","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25971"},"relatedVulnerabilities":[{"id":"CVE-2026-25971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25971","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25971","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25971"},"relatedVulnerabilities":[{"id":"CVE-2026-25971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25971","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25971","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25971","date":"2026-10-20","epss":0.00379,"percentile":0.30496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8mpr-6xr2-chhc"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25971","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-20","epss":0.00372,"percentile":0.29676}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-20","epss":0.00372,"percentile":0.29675}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"risk":0.1855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"risk":0.1855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"risk":0.1855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"risk":0.1855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"risk":0.1855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-20","epss":0.00371,"percentile":0.2963}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48994","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48994","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48994"},"relatedVulnerabilities":[{"id":"CVE-2026-48994","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4v89-6mgq-6rgc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48994","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48994","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48994","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48994"},"relatedVulnerabilities":[{"id":"CVE-2026-48994","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4v89-6mgq-6rgc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48994","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48994","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48994","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48994"},"relatedVulnerabilities":[{"id":"CVE-2026-48994","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4v89-6mgq-6rgc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48994","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48994","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48994","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48994"},"relatedVulnerabilities":[{"id":"CVE-2026-48994","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4v89-6mgq-6rgc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48994","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48994","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48994","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48994"},"relatedVulnerabilities":[{"id":"CVE-2026-48994","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48994","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-48994","date":"2026-10-20","epss":0.00367,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4v89-6mgq-6rgc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48994","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53462"},"relatedVulnerabilities":[{"id":"CVE-2026-53462","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-px7q-ggqj-hcf2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53462","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53462"},"relatedVulnerabilities":[{"id":"CVE-2026-53462","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-px7q-ggqj-hcf2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53462","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53462"},"relatedVulnerabilities":[{"id":"CVE-2026-53462","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-px7q-ggqj-hcf2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53462","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53462"},"relatedVulnerabilities":[{"id":"CVE-2026-53462","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-px7q-ggqj-hcf2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53462","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53462"},"relatedVulnerabilities":[{"id":"CVE-2026-53462","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53462","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53462","date":"2026-10-20","epss":0.00367,"percentile":0.29101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-px7q-ggqj-hcf2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53462","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-20","epss":0.00366,"percentile":0.29026}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-20","epss":0.00366,"percentile":0.29025}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-20","epss":0.00366,"percentile":0.29024}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-20","epss":0.00361,"percentile":0.28517}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-20","epss":0.00358,"percentile":0.28101}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"14cfe0f375d6d1af","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg-3.1ubuntu2.2:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=amd64&distro=ubuntu-24.04&upstream=zlib","type":"deb","version":"1:1.3.dfsg-3.1ubuntu2.2","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zlib","version":"1:1.3.dfsg-3.1ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-20","epss":0.00356,"percentile":0.2784}],"risk":0.178,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-20","epss":0.00356,"percentile":0.2784}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75466","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75466","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-10-20","epss":0.00355,"percentile":0.27741}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75466"},"relatedVulnerabilities":[{"id":"CVE-2026-75466","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-10-20","epss":0.00355,"percentile":0.27741}],"urls":["https://github.com/libjpeg-turbo/libjpeg-turbo/issues/911"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-20","epss":0.00354,"percentile":0.27659}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-20","epss":0.00353,"percentile":0.27571}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-20","epss":0.00353,"percentile":0.2757}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-20","epss":0.00348,"percentile":0.26994}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-20","epss":0.00348,"percentile":0.26994}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-20","epss":0.00344,"percentile":0.26491}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-20","epss":0.00337,"percentile":0.25677}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-20","epss":0.00335,"percentile":0.25479}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28688","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28688","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28688","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28688","date":"2026-10-20","epss":0.00333,"percentile":0.25076}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28688"},"relatedVulnerabilities":[{"id":"CVE-2026-28688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28688","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28688","date":"2026-10-20","epss":0.00333,"percentile":0.25076}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28688","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28688","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28688","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28688","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28688","date":"2026-10-20","epss":0.00333,"percentile":0.25076}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28688"},"relatedVulnerabilities":[{"id":"CVE-2026-28688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28688","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28688","date":"2026-10-20","epss":0.00333,"percentile":0.25076}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28688","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28688","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28688","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28688","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28688","date":"2026-10-20","epss":0.00333,"percentile":0.25076}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28688"},"relatedVulnerabilities":[{"id":"CVE-2026-28688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28688","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28688","date":"2026-10-20","epss":0.00333,"percentile":0.25076}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28688","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:bb06f5ce799a4e1b488461481f834f95927de085d8adf5e7cc402819abe978ce","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28688","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28688","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28688","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28688","date":"2026-10-20","epss":0.00333,"percentile":0.25076}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28688"},"relatedVulnerabilities":[{"id":"CVE-2026-28688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28688","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-28688","date":"2026-10-20","epss":0.00333,"percentile":0.25076}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28688","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]}],"grade":"A","score":"100.00","as_of":"2026-10-21T08:16:56.226Z","grype_db_version":"2026-10-21T06:31:02.000Z"}