{"grype_matches":[{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"risk":2.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"risk":2.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"risk":2.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"risk":2.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55298","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55298","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"risk":2.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55298"},"relatedVulnerabilities":[{"id":"CVE-2025-55298","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55298","cwe":"CWE-123","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-55298","cwe":"CWE-134","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55298","date":"2026-10-29","epss":0.04683,"percentile":0.91759}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55298","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"risk":0.9245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"risk":0.9245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"risk":0.9245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"risk":0.9245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"risk":0.9245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46522"},"relatedVulnerabilities":[{"id":"CVE-2026-46522","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46522","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46522","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46522","date":"2026-10-29","epss":0.01849,"percentile":0.79035}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46522","https://bugzilla.redhat.com/show_bug.cgi?id=2487730","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"risk":0.8215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56379"},"relatedVulnerabilities":[{"id":"CVE-2026-56379","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56379","cwe":"CWE-116","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-56379","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-56379","date":"2026-10-29","epss":0.01643,"percentile":0.76356}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56","https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-56379","https://bugzilla.redhat.com/show_bug.cgi?id=2491700","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56379","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-29","epss":0.01824,"percentile":0.7874}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-29","epss":0.01824,"percentile":0.7874}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-10126","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-29","epss":0.0182,"percentile":0.78689}],"risk":0.546,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-10126"},"relatedVulnerabilities":[{"id":"CVE-2018-10126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-29","epss":0.0182,"percentile":0.78689}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2786","https://gitlab.com/libtiff/libtiff/-/issues/128","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-6988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-29","epss":0.01724,"percentile":0.77459}],"risk":0.5172,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6988"},"relatedVulnerabilities":[{"id":"CVE-2019-6988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-29","epss":0.01724,"percentile":0.77459}],"urls":["http://www.securityfocus.com/bid/106785","https://github.com/uclouvain/openjpeg/issues/1178"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"risk":0.498,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"risk":0.498,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"risk":0.498,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"risk":0.498,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55212","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"risk":0.498,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55212"},"relatedVulnerabilities":[{"id":"CVE-2025-55212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55212","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55212","date":"2026-10-29","epss":0.00996,"percentile":0.62604}],"urls":["https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355","https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629","https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (\":\") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53101","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"risk":0.475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53101"},"relatedVulnerabilities":[{"id":"CVE-2025-53101","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53101","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53101","date":"2026-10-29","epss":0.0095,"percentile":0.61159}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53101","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55154","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"risk":0.47250000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55154"},"relatedVulnerabilities":[{"id":"CVE-2025-55154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55154","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55154","date":"2026-10-29","epss":0.00945,"percentile":0.61012}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82","https://goo.gle/bigsleep","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55154","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-7156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-7156","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-7156","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-7156","date":"2026-10-29","epss":0.01557,"percentile":0.75125}],"risk":0.46709999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-7156"},"relatedVulnerabilities":[{"id":"CVE-2019-7156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-7156","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-7156","date":"2026-10-29","epss":0.01557,"percentile":0.75125}],"urls":["http://www.securityfocus.com/bid/106813","https://github.com/uvoteam/libdoc/issues/5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-7156","description":"In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"risk":0.45399999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"risk":0.45399999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"risk":0.45399999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"risk":0.45399999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"risk":0.45399999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57803"},"relatedVulnerabilities":[{"id":"CVE-2025-57803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57803","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-57803","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-57803","date":"2026-10-29","epss":0.00908,"percentile":0.59852}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm","https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57803","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-29","epss":0.0148,"percentile":0.73851}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-29","epss":0.0148,"percentile":0.73851}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-7233","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-7233","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-7233","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-7233","date":"2026-10-29","epss":0.01473,"percentile":0.73739}],"risk":0.4419,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-7233"},"relatedVulnerabilities":[{"id":"CVE-2019-7233","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-7233","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-7233","date":"2026-10-29","epss":0.01473,"percentile":0.73739}],"urls":["https://github.com/uvoteam/libdoc/issues/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-7233","description":"In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-62171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-62171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-62171"},"relatedVulnerabilities":[{"id":"CVE-2025-62171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62171","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62171","date":"2026-10-29","epss":0.00809,"percentile":0.56791}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm","https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62171","description":"ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"risk":0.386,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"risk":0.386,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"risk":0.386,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"risk":0.386,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"risk":0.386,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33901"},"relatedVulnerabilities":[{"id":"CVE-2026-33901","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33901","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33901","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33901","date":"2026-10-29","epss":0.00772,"percentile":0.556}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33901","https://bugzilla.redhat.com/show_bug.cgi?id=2458023","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33901.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"risk":0.373,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"risk":0.373,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"risk":0.373,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"risk":0.373,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"risk":0.373,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25965"},"relatedVulnerabilities":[{"id":"CVE-2026-25965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25965","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25965","date":"2026-10-29","epss":0.00746,"percentile":0.54731}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25965","https://bugzilla.redhat.com/show_bug.cgi?id=2442118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25965","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53014","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"risk":0.3675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53014"},"relatedVulnerabilities":[{"id":"CVE-2025-53014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53014","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53014","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-53014","date":"2026-10-29","epss":0.00735,"percentile":0.5435}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53014","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-25664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-25664"},"relatedVulnerabilities":[{"id":"CVE-2020-25664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25664","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25664","date":"2026-10-29","epss":0.00719,"percentile":0.53795}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1891605","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z3J6D7POCQYQKNVRDYLTTPM5SQC3WVTR/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25664","description":"In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-46345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-46345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-46345","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-46345","date":"2026-10-29","epss":0.00689,"percentile":0.52657}],"risk":0.34450000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-46345"},"relatedVulnerabilities":[{"id":"CVE-2023-46345","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-46345","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-46345","date":"2026-10-29","epss":0.00689,"percentile":0.52657}],"urls":["https://gist.github.com/rycbar77/d747b2c37b544ece30b2353a65ab41f9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-46345","description":"Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"risk":0.33899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23876"},"relatedVulnerabilities":[{"id":"CVE-2026-23876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23876","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-23876","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-23876","date":"2026-10-29","epss":0.00678,"percentile":0.52223}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2fae24192b78fdfdd27d766fd21d90aeac6ea8b8","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r49w-jqq3-3gx8","https://access.redhat.com/errata/RHSA-2026:3058","https://access.redhat.com/security/cve/CVE-2026-23876","https://bugzilla.redhat.com/show_bug.cgi?id=2431038","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23876.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23876","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25989","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25989"},"relatedVulnerabilities":[{"id":"CVE-2026-25989","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25989","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-681","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25989","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25989","date":"2026-10-29","epss":0.00661,"percentile":0.51533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25989","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-68618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-68618"},"relatedVulnerabilities":[{"id":"CVE-2025-68618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68618","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68618","date":"2026-10-29","epss":0.00647,"percentile":0.50914}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68618","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"5d668b4eb9cdb47a","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-29","epss":0.0063,"percentile":0.50098}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-29","epss":0.0063,"percentile":0.50098}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"bc00ecb2bdfc2b6f","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-29","epss":0.0063,"percentile":0.50098}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-29","epss":0.0063,"percentile":0.50098}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"bdd817d23e512645","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-29","epss":0.0063,"percentile":0.50098}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-29","epss":0.0063,"percentile":0.50098}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"c9080c1b63d1cc8f","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.6?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-29","epss":0.0063,"percentile":0.50098}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-29","epss":0.0063,"percentile":0.50098}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-69204","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"risk":0.3005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69204"},"relatedVulnerabilities":[{"id":"CVE-2025-69204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69204","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-69204","date":"2026-10-29","epss":0.00601,"percentile":0.48678}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2c08c2311693759153c9aa99a6b2dcb5f985681e","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hrh7-j8q2-4qcw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69204","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-39329","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-29","epss":0.00588,"percentile":0.48044}],"risk":0.294,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-39329"},"relatedVulnerabilities":[{"id":"CVE-2023-39329","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-29","epss":0.00588,"percentile":0.48044}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39329","https://bugzilla.redhat.com/show_bug.cgi?id=2295816","https://github.com/uclouvain/openjpeg/issues/1474"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-43965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-43965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-43965"},"relatedVulnerabilities":[{"id":"CVE-2025-43965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-43965","cwe":"CWE-131","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-43965","date":"2026-10-29","epss":0.00587,"percentile":0.47969}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9","https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22","https://lists.debian.org/debian-lts-announce/2025/04/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-43965","description":"In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used."}]},{"artifact":{"id":"12838fd0d4234cbd","cpes":["cpe:2.3:a:libpixman-1-0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1-0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*"],"name":"libpixman-1-0","purl":"pkg:deb/ubuntu/libpixman-1-0@0.42.2-1build1?arch=amd64&distro=ubuntu-24.04&upstream=pixman","type":"deb","version":"0.42.2-1build1","language":"","licenses":["sha256:1b3fb5690861e15ca4fd6640fd4def4b2576617942eec04b6fcb7d8bc6c4c9da"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpixman-1-0/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libpixman-1-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pixman"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-37769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pixman","version":"0.42.2-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-37769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-29","epss":0.00586,"percentile":0.47954}],"risk":0.293,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-37769"},"relatedVulnerabilities":[{"id":"CVE-2023-37769","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-29","epss":0.00586,"percentile":0.47954}],"urls":["https://gitlab.freedesktop.org/pixman/pixman/-/issues/76"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37769","description":"stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4775","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-29","epss":0.0057,"percentile":0.47103}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4775"},"relatedVulnerabilities":[{"id":"CVE-2026-4775","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-29","epss":0.0057,"percentile":0.47103}],"urls":["https://access.redhat.com/errata/RHSA-2026:12265","https://access.redhat.com/errata/RHSA-2026:12271","https://access.redhat.com/errata/RHSA-2026:14929","https://access.redhat.com/errata/RHSA-2026:16055","https://access.redhat.com/errata/RHSA-2026:19150","https://access.redhat.com/errata/RHSA-2026:19363","https://access.redhat.com/errata/RHSA-2026:19585","https://access.redhat.com/errata/RHSA-2026:19586","https://access.redhat.com/errata/RHSA-2026:19604","https://access.redhat.com/errata/RHSA-2026:19608","https://access.redhat.com/errata/RHSA-2026:19609","https://access.redhat.com/errata/RHSA-2026:19657","https://access.redhat.com/errata/RHSA-2026:19659","https://access.redhat.com/errata/RHSA-2026:19702","https://access.redhat.com/errata/RHSA-2026:20583","https://access.redhat.com/errata/RHSA-2026:20585","https://access.redhat.com/errata/RHSA-2026:20591","https://access.redhat.com/errata/RHSA-2026:20592","https://access.redhat.com/errata/RHSA-2026:24992","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25910","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30349","https://access.redhat.com/errata/RHSA-2026:33388","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-4775","https://bugzilla.redhat.com/show_bug.cgi?id=2450768","https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4775","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."}]},{"artifact":{"id":"44cffe49b484d7fa","cpes":["cpe:2.3:a:unrtf:unrtf:0.21.10-clean-1:*:*:*:*:*:*:*"],"name":"unrtf","purl":"pkg:deb/ubuntu/unrtf@0.21.10-clean-1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.21.10-clean-1","language":"","licenses":["sha256:da496fdffef01c170e100d6b2d68fe7ef0b85a6d9e34eb6180d205d74bdde350"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/unrtf/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/unrtf/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/unrtf.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/unrtf.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/unrtf.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/unrtf.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-65411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"unrtf","version":"0.21.10-clean-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-65411","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-65411","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-65411","date":"2026-10-29","epss":0.00568,"percentile":0.46991}],"risk":0.28400000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-65411"},"relatedVulnerabilities":[{"id":"CVE-2025-65411","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-65411","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-65411","date":"2026-10-29","epss":0.00568,"percentile":0.46991}],"urls":["https://github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65411.md","https://lists.gnu.org/archive/html/bug-unrtf/2025-11/msg00000.html","https://savannah.gnu.org/projects/unrtf/","https://sources.debian.org/src/unrtf/0.21.10-clean-1/src/main.c/#L661","https://www.gnu.org/software/unrtf/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-65411","description":"A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-20453","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-20453","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20453","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20453","date":"2026-10-29","epss":0.00944,"percentile":0.60977}],"risk":0.2832,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20453"},"relatedVulnerabilities":[{"id":"CVE-2018-20453","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20453","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20453","date":"2026-10-29","epss":0.00944,"percentile":0.60977}],"urls":["https://github.com/uvoteam/libdoc/issues/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20453","description":"The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file."}]},{"artifact":{"id":"b6757afb558405cc","cpes":["cpe:2.3:a:libpoppler134:libpoppler134:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"libpoppler134","purl":"pkg:deb/ubuntu/libpoppler134@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler134/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libpoppler134/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93311","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93311","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-10-29","epss":0.00562,"percentile":0.46661}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93311"},"relatedVulnerabilities":[{"id":"CVE-2026-93311","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-10-29","epss":0.00562,"percentile":0.46661}],"urls":["https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758","https://vuldb.com/cve/CVE-2026-93311","https://vuldb.com/submit/942344","https://vuldb.com/vuln/406609","https://vuldb.com/vuln/406609/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93311","description":"A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet."}]},{"artifact":{"id":"9a68e14490dec426","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/ubuntu/poppler-utils@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93311","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93311","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-10-29","epss":0.00562,"percentile":0.46661}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93311"},"relatedVulnerabilities":[{"id":"CVE-2026-93311","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93311","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-93311","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-93311","date":"2026-10-29","epss":0.00562,"percentile":0.46661}],"urls":["https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md","https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758","https://vuldb.com/cve/CVE-2026-93311","https://vuldb.com/submit/942344","https://vuldb.com/vuln/406609","https://vuldb.com/vuln/406609/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93311","description":"A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-20451","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-20451","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20451","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20451","date":"2026-10-29","epss":0.00936,"percentile":0.60741}],"risk":0.2808,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20451"},"relatedVulnerabilities":[{"id":"CVE-2018-20451","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20451","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20451","date":"2026-10-29","epss":0.00936,"percentile":0.60741}],"urls":["https://github.com/uvoteam/libdoc/issues/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20451","description":"The process_file function in reader.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53019","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-53019","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"risk":0.27899999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53019"},"relatedVulnerabilities":[{"id":"CVE-2025-53019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53019","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-53019","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-53019","date":"2026-10-29","epss":0.00558,"percentile":0.46425}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc","https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"risk":0.2785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"risk":0.2785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"risk":0.2785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"risk":0.2785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"risk":0.2785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25985"},"relatedVulnerabilities":[{"id":"CVE-2026-25985","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25985","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25985","date":"2026-10-29","epss":0.00557,"percentile":0.46402}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84","https://access.redhat.com/errata/RHSA-2026:5573","https://access.redhat.com/security/cve/CVE-2026-25985","https://bugzilla.redhat.com/show_bug.cgi?id=2442127","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25985.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25985","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"risk":0.27699999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61861"},"relatedVulnerabilities":[{"id":"CVE-2026-61861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61861","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61861","date":"2026-10-29","epss":0.00554,"percentile":0.46191}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-in-formatmagickcaption"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61861","description":"ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25986","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25986"},"relatedVulnerabilities":[{"id":"CVE-2026-25986","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25986","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25986","date":"2026-10-29","epss":0.00524,"percentile":0.44375}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25986","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-29","epss":0.00521,"percentile":0.44155}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-29","epss":0.00521,"percentile":0.44155}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-29","epss":0.00521,"percentile":0.44155}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-29","epss":0.00521,"percentile":0.44155}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-29","epss":0.00521,"percentile":0.44155}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-29","epss":0.00521,"percentile":0.44155}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-29","epss":0.00521,"percentile":0.44155}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-29","epss":0.00521,"percentile":0.44155}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"ec7bc8c431630985","cpes":["cpe:2.3:a:libheif-plugin-aomdec:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-aomdec:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_aomdec:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_aomdec:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*"],"name":"libheif-plugin-aomdec","purl":"pkg:deb/ubuntu/libheif-plugin-aomdec@1.17.6-1ubuntu4.9?arch=amd64&distro=ubuntu-24.04&upstream=libheif","type":"deb","version":"1.17.6-1ubuntu4.9","language":"","licenses":["BOOST-1.0","BSD-3-clause","BSD-4-clause","GPL-3","GPL-3+","LGPL-3","LGPL-3+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-aomdec/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libheif-plugin-aomdec/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-aomdec:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libheif-plugin-aomdec:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libheif","version":"1.17.6-1ubuntu4.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-29","epss":0.00517,"percentile":0.43938}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84447"},"relatedVulnerabilities":[{"id":"CVE-2026-84447","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-29","epss":0.00517,"percentile":0.43938}],"urls":["https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."}]},{"artifact":{"id":"fe8b2702206cdb90","cpes":["cpe:2.3:a:libheif1:libheif1:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*"],"name":"libheif1","purl":"pkg:deb/ubuntu/libheif1@1.17.6-1ubuntu4.9?arch=amd64&distro=ubuntu-24.04&upstream=libheif","type":"deb","version":"1.17.6-1ubuntu4.9","language":"","licenses":["BOOST-1.0","BSD-3-clause","BSD-4-clause","GPL-3","GPL-3+","LGPL-3","LGPL-3+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif1/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libheif1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif1:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libheif1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libheif","version":"1.17.6-1ubuntu4.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-29","epss":0.00517,"percentile":0.43938}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84447"},"relatedVulnerabilities":[{"id":"CVE-2026-84447","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-29","epss":0.00517,"percentile":0.43938}],"urls":["https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33908","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33908","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33908"},"relatedVulnerabilities":[{"id":"CVE-2026-33908","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33908","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33908","cwe":"CWE-776","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33908","date":"2026-10-29","epss":0.0051,"percentile":0.4346}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66628","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66628","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66628"},"relatedVulnerabilities":[{"id":"CVE-2025-66628","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66628","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-66628","date":"2026-10-29","epss":0.0051,"percentile":0.43432}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8","https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a79615994787b14f9048b1c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66628","description":"ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26983"},"relatedVulnerabilities":[{"id":"CVE-2026-26983","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26983","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26983","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26983","date":"2026-10-29","epss":0.00501,"percentile":0.42809}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"risk":0.25,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"risk":0.25,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"risk":0.25,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"risk":0.25,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24485","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"risk":0.25,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24485"},"relatedVulnerabilities":[{"id":"CVE-2026-24485","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24485","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24485","date":"2026-10-29","epss":0.005,"percentile":0.4277}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/332c1566acc2de77857032d3c2504ead6210ff50","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24485","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25988"},"relatedVulnerabilities":[{"id":"CVE-2026-25988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25988","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25988","date":"2026-10-29","epss":0.00498,"percentile":0.42584}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25988","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45031","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45031"},"relatedVulnerabilities":[{"id":"CVE-2026-45031","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45031","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45031","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45031","date":"2026-10-29","epss":0.00495,"percentile":0.42408}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45031","https://bugzilla.redhat.com/show_bug.cgi?id=2487734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45031.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25983","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25983"},"relatedVulnerabilities":[{"id":"CVE-2026-25983","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25983","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25983","date":"2026-10-29","epss":0.00494,"percentile":0.42365}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25983","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32636"},"relatedVulnerabilities":[{"id":"CVE-2026-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32636","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32636","date":"2026-10-29","epss":0.00493,"percentile":0.42298}],"urls":["https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-17","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gc62-2v5p-qpmp","https://github.com/dlemstra/Magick.NET/releases/tag/14.11.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32636","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"risk":0.24350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"risk":0.24350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"risk":0.24350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"risk":0.24350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"risk":0.24350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25798"},"relatedVulnerabilities":[{"id":"CVE-2026-25798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25798","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25798","date":"2026-10-29","epss":0.00487,"percentile":0.41861}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25798","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-10-29","epss":0.00474,"percentile":0.40922}],"risk":0.23700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-113351"},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-10-29","epss":0.00474,"percentile":0.40922}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-23952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-23952","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-23952"},"relatedVulnerabilities":[{"id":"CVE-2026-23952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23952","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-23952","date":"2026-10-29","epss":0.00471,"percentile":0.40704}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23952","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56368"},"relatedVulnerabilities":[{"id":"CVE-2026-56368","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56368","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56368","date":"2026-10-29","epss":0.0046,"percentile":0.39873}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56368","description":"ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"risk":0.2275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"risk":0.2275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"risk":0.2275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"risk":0.2275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24484","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"risk":0.2275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24484"},"relatedVulnerabilities":[{"id":"CVE-2026-24484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24484","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24484","date":"2026-10-29","epss":0.00455,"percentile":0.3948}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv","https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24484","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-10-29","epss":0.00455,"percentile":0.39459}],"risk":0.2275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115506"},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-10-29","epss":0.00455,"percentile":0.39459}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86421"},"relatedVulnerabilities":[{"id":"CVE-2026-86421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86421","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-86421","date":"2026-10-29","epss":0.00453,"percentile":0.39322}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-30-memory-leak-via-msl-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86421","description":"ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26284"},"relatedVulnerabilities":[{"id":"CVE-2026-26284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26284","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26284","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26284","date":"2026-10-29","epss":0.0045,"percentile":0.39029}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26284","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-10-29","epss":0.00442,"percentile":0.38371}],"risk":0.22100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118370"},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-10-29","epss":0.00442,"percentile":0.38371}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106573"},"relatedVulnerabilities":[{"id":"CVE-2026-106573","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106573","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106573","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106573","date":"2026-10-29","epss":0.00441,"percentile":0.38232}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62","https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106573","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46520"},"relatedVulnerabilities":[{"id":"CVE-2026-46520","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46520","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46520","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46520","date":"2026-10-29","epss":0.00441,"percentile":0.38231}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-46520","https://bugzilla.redhat.com/show_bug.cgi?id=2487729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46520.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-45664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45664"},"relatedVulnerabilities":[{"id":"CVE-2026-45664","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45664","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45664","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45664","date":"2026-10-29","epss":0.00441,"percentile":0.3823}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-45664","https://bugzilla.redhat.com/show_bug.cgi?id=2487732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45664.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56371","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56371"},"relatedVulnerabilities":[{"id":"CVE-2026-56371","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56371","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56371","date":"2026-10-29","epss":0.0044,"percentile":0.38156}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8","https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-txt-file-processing-via-texture-attribute"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56371","description":"ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25799","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25799"},"relatedVulnerabilities":[{"id":"CVE-2026-25799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25799","cwe":"CWE-369","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25799","date":"2026-10-29","epss":0.00437,"percentile":0.37947}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25799","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33900","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33900"},"relatedVulnerabilities":[{"id":"CVE-2026-33900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33900","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33900","date":"2026-10-29","epss":0.00434,"percentile":0.37637}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33900","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12912","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12912","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-29","epss":0.00433,"percentile":0.37514}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12912"},"relatedVulnerabilities":[{"id":"CVE-2026-12912","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-29","epss":0.00433,"percentile":0.37514}],"urls":["https://access.redhat.com/errata/RHSA-2026:34890","https://access.redhat.com/errata/RHSA-2026:41892","https://access.redhat.com/errata/RHSA-2026:42668","https://access.redhat.com/errata/RHSA-2026:47183","https://access.redhat.com/errata/RHSA-2026:47184","https://access.redhat.com/errata/RHSA-2026:49671","https://access.redhat.com/errata/RHSA-2026:50774","https://access.redhat.com/errata/RHSA-2026:54638","https://access.redhat.com/errata/RHSA-2026:54640","https://access.redhat.com/errata/RHSA-2026:54642","https://access.redhat.com/errata/RHSA-2026:58545","https://access.redhat.com/errata/RHSA-2026:58553","https://access.redhat.com/errata/RHSA-2026:58554","https://access.redhat.com/errata/RHSA-2026:58556","https://access.redhat.com/errata/RHSA-2026:61657","https://access.redhat.com/errata/RHSA-2026:69292","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:83550","https://access.redhat.com/security/cve/CVE-2026-12912","https://bugzilla.redhat.com/show_bug.cgi?id=2492871","https://gitlab.com/libtiff/libtiff/-/merge_requests/873","https://gitlab.com/libtiff/libtiff/-/work_items/824","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12912","description":"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24481","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-24481","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24481"},"relatedVulnerabilities":[{"id":"CVE-2026-24481","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24481","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24481","date":"2026-10-29","epss":0.00432,"percentile":0.3749}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24481","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33899"},"relatedVulnerabilities":[{"id":"CVE-2026-33899","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33899","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33899","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33899","date":"2026-10-29","epss":0.00428,"percentile":0.37003}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae679e2fd19ec656bfab9f822ae4cf06bf91604d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33899","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25795"},"relatedVulnerabilities":[{"id":"CVE-2026-25795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25795","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25795","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25795","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25796"},"relatedVulnerabilities":[{"id":"CVE-2026-25796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25796","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25796","date":"2026-10-29","epss":0.00427,"percentile":0.36878}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25796","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106576","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106576","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"risk":0.213,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106576"},"relatedVulnerabilities":[{"id":"CVE-2026-106576","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106576","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106576","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106576","date":"2026-10-29","epss":0.00426,"percentile":0.36836}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f491576297141ff685dc4460d811986f5b6b6cec","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v45j-x8p4-3mh4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106576","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-10-29","epss":0.00425,"percentile":0.36763}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117610"},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-10-29","epss":0.00425,"percentile":0.36763}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-29","epss":0.00425,"percentile":0.36686}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-29","epss":0.00425,"percentile":0.36686}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-29","epss":0.00424,"percentile":0.36661}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-29","epss":0.00424,"percentile":0.36661}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-29","epss":0.00424,"percentile":0.36661}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-29","epss":0.00424,"percentile":0.36661}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-29","epss":0.00424,"percentile":0.36661}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-29","epss":0.00424,"percentile":0.36661}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-29","epss":0.00424,"percentile":0.36661}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-29","epss":0.00424,"percentile":0.36661}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109267","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109267","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109267"},"relatedVulnerabilities":[{"id":"CVE-2026-109267","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109267","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109267","date":"2026-10-29","epss":0.00424,"percentile":0.36646}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2","https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25987","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25987"},"relatedVulnerabilities":[{"id":"CVE-2026-25987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25987","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25987","date":"2026-10-29","epss":0.00421,"percentile":0.36327}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25987","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106565"},"relatedVulnerabilities":[{"id":"CVE-2026-106565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106565","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106565","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106565","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h","https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106565","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106567"},"relatedVulnerabilities":[{"id":"CVE-2026-106567","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106567","cwe":"CWE-196","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106567","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106567","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f053f778409932d55b95758c4b1516b63191d1eb","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j","https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106567","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106578","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106578"},"relatedVulnerabilities":[{"id":"CVE-2026-106578","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106578","cwe":"CWE-590","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106578","date":"2026-10-29","epss":0.0042,"percentile":0.36272}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39","https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106578","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-55160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-55160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-55160"},"relatedVulnerabilities":[{"id":"CVE-2025-55160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-55160","cwe":"CWE-758","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-55160","date":"2026-10-29","epss":0.00414,"percentile":0.35597}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109264"},"relatedVulnerabilities":[{"id":"CVE-2026-109264","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109264","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109264","date":"2026-10-29","epss":0.00404,"percentile":0.34636}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c","https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-29","epss":0.00403,"percentile":0.34525}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93990"},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-29","epss":0.00403,"percentile":0.34525}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25898","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25898"},"relatedVulnerabilities":[{"id":"CVE-2026-25898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25898","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25898","date":"2026-10-29","epss":0.00395,"percentile":0.33628}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25898","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56378"},"relatedVulnerabilities":[{"id":"CVE-2026-56378","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56378","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56378","date":"2026-10-29","epss":0.00389,"percentile":0.32961}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","https://www.vulncheck.com/advisories/imagemagick-heap-out-of-bounds-read-in-pcd-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56378","description":"ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25982","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25982"},"relatedVulnerabilities":[{"id":"CVE-2026-25982","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25982","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25982","date":"2026-10-29","epss":0.00386,"percentile":0.32579}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmq6-8289-hx3v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25982","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106572"},"relatedVulnerabilities":[{"id":"CVE-2026-106572","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106572","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106572","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr","https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106572","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109262"},"relatedVulnerabilities":[{"id":"CVE-2026-109262","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109262","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109262","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp","https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-svg-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109276","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109276"},"relatedVulnerabilities":[{"id":"CVE-2026-109276","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109276","cwe":"CWE-459","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109276","date":"2026-10-29","epss":0.00384,"percentile":0.32428}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r","https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-temporary-file-leak-in-jng-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106568"},"relatedVulnerabilities":[{"id":"CVE-2026-106568","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106568","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106568","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4","https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106568","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106569"},"relatedVulnerabilities":[{"id":"CVE-2026-106569","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106569","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106569","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106569","date":"2026-10-29","epss":0.00384,"percentile":0.32427}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/0691546106f4c7e8857da9f21a0e4a8f41915388","https://github.com/ImageMagick/ImageMagick/commit/5ecd5b047cee7ccfe4e14a733a0755c7b2a90c7d","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwj6-pm7x-3r63"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106569","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-26066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-26066","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-26066"},"relatedVulnerabilities":[{"id":"CVE-2026-26066","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-26066","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-26066","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-26066","date":"2026-10-29","epss":0.00372,"percentile":0.3107}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26066","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106564","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106564","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106564"},"relatedVulnerabilities":[{"id":"CVE-2026-106564","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106564","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106564","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106564","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/f7437ebafcd92d6959eca4086d80b150d52bdb7c","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54rx-5x9g-g465"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106564","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109265","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109265","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109265"},"relatedVulnerabilities":[{"id":"CVE-2026-109265","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109265","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109265","date":"2026-10-29","epss":0.00372,"percentile":0.31049}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg","https://www.vulncheck.com/advisories/imagemagick-7.1.1-7-before-7.1.2-32-heap-buffer-over-read-via-xmp-profile"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","description":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106575","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106575","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106575"},"relatedVulnerabilities":[{"id":"CVE-2026-106575","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106575","cwe":"CWE-775","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106575","date":"2026-10-29","epss":0.00372,"percentile":0.31047}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/86672a16cedbf5a06d64e629e058310d683bb48e","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2w4h-697j-4vrm"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106575","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"risk":0.1845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"risk":0.1845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"risk":0.1845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"risk":0.1845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25638","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25638","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"risk":0.1845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25638"},"relatedVulnerabilities":[{"id":"CVE-2026-25638","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25638","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-25638","date":"2026-10-29","epss":0.00369,"percentile":0.30742}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gxcx-qjqp-8vjw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25638","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-29","epss":0.00368,"percentile":0.30592}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-29","epss":0.00368,"percentile":0.30592}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"risk":0.1835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28691"},"relatedVulnerabilities":[{"id":"CVE-2026-28691","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28691","cwe":"CWE-252","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28691","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28691","date":"2026-10-29","epss":0.00367,"percentile":0.30533}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wj8w-pjxf-9g4f","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28691","https://bugzilla.redhat.com/show_bug.cgi?id=2445902","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28691.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28691","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109260"},"relatedVulnerabilities":[{"id":"CVE-2026-109260","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109260","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109260","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3","https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-png-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109261","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109261"},"relatedVulnerabilities":[{"id":"CVE-2026-109261","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109261","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109261","date":"2026-10-29","epss":0.00366,"percentile":0.30432}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4","https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-gif-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109263","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109263","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109263"},"relatedVulnerabilities":[{"id":"CVE-2026-109263","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109263","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109263","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4","https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-yuv-encoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109268"},"relatedVulnerabilities":[{"id":"CVE-2026-109268","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109268","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109268","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv","https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109278","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109278","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109278"},"relatedVulnerabilities":[{"id":"CVE-2026-109278","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109278","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109278","date":"2026-10-29","epss":0.00366,"percentile":0.30431}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c","https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-memory-leak-in-wavelet-denoise-operation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"risk":0.183,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109271"},"relatedVulnerabilities":[{"id":"CVE-2026-109271","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109271","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109271","date":"2026-10-29","epss":0.00366,"percentile":0.30392}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6","https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x","https://www.vulncheck.com/advisories/imagemagick-7.1.2-30-before-7.1.2-32-use-after-free-in-wbinfo-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","description":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application."}]},{"artifact":{"id":"15d723141971bb2c","cpes":["cpe:2.3:a:ryan-grove:crass:1.0.7:*:*:*:*:*:*:*","cpe:2.3:a:ryan_grove:crass:1.0.7:*:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:crass:1.0.7:*:*:*:*:*:*:*","cpe:2.3:a:ruby_lang:crass:1.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rgrove:crass:1.0.7:*:*:*:*:*:*:*","cpe:2.3:a:crass:crass:1.0.7:*:*:*:*:*:*:*","cpe:2.3:a:ruby:crass:1.0.7:*:*:*:*:*:*:*"],"name":"crass","purl":"pkg:gem/crass@1.0.7","type":"gem","version":"1.0.7","language":"ruby","licenses":["MIT"],"locations":[{"path":"/app/vendor/bundle/ruby/4.0.0/specifications/crass-1.0.7.gemspec","layerID":"sha256:c3caea76648b3025c4cec55e62c7e82d72ebb52aad0d05d11938f26da0b95b59","accessPath":"/app/vendor/bundle/ruby/4.0.0/specifications/crass-1.0.7.gemspec","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pq4g-8rxf-4g29","versionConstraint":"<=1.0.7 (gem)"},"matcher":"ruby-gem-matcher","searchedBy":{"package":{"name":"crass","version":"1.0.7"},"language":"ruby","namespace":"github:language:ruby"}}],"vulnerability":{"id":"GHSA-pq4g-8rxf-4g29","fix":{"state":"fixed","versions":["1.0.8"],"available":[{"date":"2026-10-29","kind":"first-observed","version":"1.0.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116695","cwe":"CWE-436","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116695","date":"2026-10-29","epss":0.00353,"percentile":0.2897}],"risk":0.181795,"urls":["https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29","https://nvd.nist.gov/vuln/detail/CVE-2026-116695","https://github.com/rgrove/crass/commit/689fc45c632fdf3803b2f4e844ffc9cca3b08f34","https://github.com/rgrove/crass/releases/tag/v1.0.8","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-pq4g-8rxf-4g29.yml"],"severity":"Medium","namespace":"github:language:ruby","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pq4g-8rxf-4g29","description":"Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-116695","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116695","cwe":"CWE-436","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116695","date":"2026-10-29","epss":0.00353,"percentile":0.2897}],"urls":["https://github.com/rgrove/crass/commit/689fc45c632fdf3803b2f4e844ffc9cca3b08f34","https://github.com/rgrove/crass/releases/tag/v1.0.8","https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116695","description":"Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109964"},"relatedVulnerabilities":[{"id":"CVE-2026-109964","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109964","cwe":"CWE-124","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109964","date":"2026-10-29","epss":0.00361,"percentile":0.29892}],"urls":["https://github.com/ImageMagick/ImageMagick","https://github.com/ImageMagick/ImageMagick/blob/7.1.2-32/coders/pict.c#L503-L540","https://github.com/ImageMagick/ImageMagick/commit/63dde0cf281383ab69432b88305f7dcd6a8ce900","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w","https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-and-6.9.13-58-heap-buffer-underwrite-in-pict-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109964","description":"ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75466","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75466","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-10-29","epss":0.00355,"percentile":0.29131}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75466"},"relatedVulnerabilities":[{"id":"CVE-2026-75466","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-10-29","epss":0.00355,"percentile":0.29131}],"urls":["https://github.com/libjpeg-turbo/libjpeg-turbo/issues/911"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109272","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109272","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109272"},"relatedVulnerabilities":[{"id":"CVE-2026-109272","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109272","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109272","date":"2026-10-29","epss":0.00354,"percentile":0.29102}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72","https://www.vulncheck.com/advisories/imagemagick-7.1.1-31-before-7.1.2-32-null-pointer-dereference-in-postscript-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","description":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61860"},"relatedVulnerabilities":[{"id":"CVE-2026-61860","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61860","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61860","date":"2026-10-29","epss":0.00353,"percentile":0.28966}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm","https://www.vulncheck.com/advisories/imagemagick-before-26-use-after-free-via-freetype"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61860","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61871","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61871","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61871"},"relatedVulnerabilities":[{"id":"CVE-2026-61871","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61871","cwe":"CWE-401","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-61871","date":"2026-10-29","epss":0.00353,"percentile":0.28965}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-icon-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61871","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53461"},"relatedVulnerabilities":[{"id":"CVE-2026-53461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53461","date":"2026-10-29","epss":0.00353,"percentile":0.28942}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr","https://access.redhat.com/security/cve/CVE-2026-53461","https://bugzilla.redhat.com/show_bug.cgi?id=2487764","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53461","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-116149","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116149","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116149"},"relatedVulnerabilities":[{"id":"CVE-2026-116149","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116149","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116149","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116149","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116149"},"relatedVulnerabilities":[{"id":"CVE-2026-116149","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116149","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116149","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116149","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116149"},"relatedVulnerabilities":[{"id":"CVE-2026-116149","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116149","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116149","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116149","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116149"},"relatedVulnerabilities":[{"id":"CVE-2026-116149","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116149","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116149","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116149","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116149"},"relatedVulnerabilities":[{"id":"CVE-2026-116149","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116149","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116149","date":"2026-10-29","epss":0.00348,"percentile":0.28424}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116149","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:bec87777bc2fb2edcdf9af11df1531469e7df911309c1413082b18fcb8610278","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-29","epss":0.00348,"percentile":0.28397}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-29","epss":0.00348,"percentile":0.28397}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106577","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106577","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106577"},"relatedVulnerabilities":[{"id":"CVE-2026-106577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106577","cwe":"CWE-94","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106577","date":"2026-10-29","epss":0.00348,"percentile":0.28376}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192","https://github.com/ImageMagick/ImageMagick/commit/78378cd623468760bee82a5930cb3011725916f8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892","https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53","https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106577","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-28693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28693"},"relatedVulnerabilities":[{"id":"CVE-2026-28693","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28693","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-28693","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-28693","date":"2026-10-29","epss":0.00348,"percentile":0.28331}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hffp-q43q-qq76","https://access.redhat.com/errata/RHSA-2026:6713","https://access.redhat.com/security/cve/CVE-2026-28693","https://bugzilla.redhat.com/show_bug.cgi?id=2445888","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28693","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53460"},"relatedVulnerabilities":[{"id":"CVE-2026-53460","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-53460","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-53460","date":"2026-10-29","epss":0.00346,"percentile":0.28123}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-53460","https://bugzilla.redhat.com/show_bug.cgi?id=2487757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53460.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53460","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49218"},"relatedVulnerabilities":[{"id":"CVE-2026-49218","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49218","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49218","cwe":"CWE-1284","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49218","date":"2026-10-29","epss":0.00346,"percentile":0.28122}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc","https://access.redhat.com/errata/RHSA-2026:32961","https://access.redhat.com/security/cve/CVE-2026-49218","https://bugzilla.redhat.com/show_bug.cgi?id=2487763","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49218.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49218","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-48877","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-48877","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-48877","cwe":"CWE-680","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2024-48877","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-48877","date":"2026-10-29","epss":0.00344,"percentile":0.27899}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-48877"},"relatedVulnerabilities":[{"id":"CVE-2024-48877","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-48877","cwe":"CWE-680","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2024-48877","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-48877","date":"2026-10-29","epss":0.00344,"percentile":0.27899}],"urls":["https://talosintelligence.com/vulnerability_reports/TALOS-2024-2128","https://lists.debian.org/debian-lts-announce/2025/06/msg00032.html","https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2128"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-48877","description":"A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"risk":0.17149999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"risk":0.17149999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"risk":0.17149999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"risk":0.17149999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25897","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"risk":0.17149999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25897"},"relatedVulnerabilities":[{"id":"CVE-2026-25897","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25897","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-25897","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-25897","date":"2026-10-29","epss":0.00343,"percentile":0.27762}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25897","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"risk":0.16949999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107210"},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"risk":0.16949999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107210"},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"risk":0.16949999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107210"},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"risk":0.16949999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107210"},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107210","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"risk":0.16949999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107210"},"relatedVulnerabilities":[{"id":"CVE-2026-107210","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107210","cwe":"CWE-409","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107210","date":"2026-10-29","epss":0.00339,"percentile":0.27291}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc","https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107210","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109275","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109275","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109275"},"relatedVulnerabilities":[{"id":"CVE-2026-109275","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109275","cwe":"CWE-74","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-109275","date":"2026-10-29","epss":0.00337,"percentile":0.27138}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5","https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-mvg-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","description":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path."}]},{"artifact":{"id":"c63c50e09a049480","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-29","epss":0.00337,"percentile":0.27097}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-29","epss":0.00337,"percentile":0.27097}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"cd1ded1d948407f7","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-29","epss":0.00337,"percentile":0.27097}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-29","epss":0.00337,"percentile":0.27097}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-52035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52035","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52035","cwe":"CWE-190","type":"Secondary","source":"talos-cna@cisco.com"}],"epss":[{"cve":"CVE-2024-52035","date":"2026-10-29","epss":0.00337,"percentile":0.27067}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52035"},"relatedVulnerabilities":[{"id":"CVE-2024-52035","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52035","cwe":"CWE-190","type":"Secondary","source":"talos-cna@cisco.com"}],"epss":[{"cve":"CVE-2024-52035","date":"2026-10-29","epss":0.00337,"percentile":0.27067}],"urls":["https://talosintelligence.com/vulnerability_reports/TALOS-2024-2131","https://lists.debian.org/debian-lts-announce/2025/06/msg00032.html","https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2131"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52035","description":"An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability."}]},{"artifact":{"id":"ed39b7071a005c24","cpes":["cpe:2.3:a:catdoc:catdoc:1\\:0.95-5build1:*:*:*:*:*:*:*"],"name":"catdoc","purl":"pkg:deb/ubuntu/catdoc@1%3A0.95-5build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:0.95-5build1","language":"","licenses":["GPL-2","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/catdoc/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/catdoc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/catdoc.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/catdoc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-54028","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"catdoc","version":"1:0.95-5build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-54028","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-54028","cwe":"CWE-191","type":"Secondary","source":"talos-cna@cisco.com"}],"epss":[{"cve":"CVE-2024-54028","date":"2026-10-29","epss":0.00337,"percentile":0.27067}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-54028"},"relatedVulnerabilities":[{"id":"CVE-2024-54028","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-54028","cwe":"CWE-191","type":"Secondary","source":"talos-cna@cisco.com"}],"epss":[{"cve":"CVE-2024-54028","date":"2026-10-29","epss":0.00337,"percentile":0.27067}],"urls":["https://talosintelligence.com/vulnerability_reports/TALOS-2024-2132","https://lists.debian.org/debian-lts-announce/2025/06/msg00032.html","https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2132"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-54028","description":"An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93589"},"relatedVulnerabilities":[{"id":"CVE-2026-93589","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93589","cwe":"CWE-369","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93589","date":"2026-10-29","epss":0.00335,"percentile":0.26877}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-division-by-zero-in-flif-encoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93589","description":"ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-116141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116141","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116141"},"relatedVulnerabilities":[{"id":"CVE-2026-116141","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-in-uhdr-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116141","description":"ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116141","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116141"},"relatedVulnerabilities":[{"id":"CVE-2026-116141","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-in-uhdr-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116141","description":"ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116141","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116141"},"relatedVulnerabilities":[{"id":"CVE-2026-116141","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-in-uhdr-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116141","description":"ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116141","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116141"},"relatedVulnerabilities":[{"id":"CVE-2026-116141","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-in-uhdr-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116141","description":"ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-116141","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116141"},"relatedVulnerabilities":[{"id":"CVE-2026-116141","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116141","cwe":"CWE-400","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-116141","date":"2026-10-29","epss":0.00333,"percentile":0.26496}],"urls":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g","https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-in-uhdr-decoder"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116141","description":"ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114723","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114723"},"relatedVulnerabilities":[{"id":"CVE-2026-114723","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"urls":["https://bugs.debian.org/1151279","https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f","https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33362e3f04cf","https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114723","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114723","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114723"},"relatedVulnerabilities":[{"id":"CVE-2026-114723","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"urls":["https://bugs.debian.org/1151279","https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f","https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33362e3f04cf","https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114723","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114723","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114723"},"relatedVulnerabilities":[{"id":"CVE-2026-114723","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"urls":["https://bugs.debian.org/1151279","https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f","https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33362e3f04cf","https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114723","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114723","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114723"},"relatedVulnerabilities":[{"id":"CVE-2026-114723","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"urls":["https://bugs.debian.org/1151279","https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f","https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33362e3f04cf","https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114723","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114723","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114723"},"relatedVulnerabilities":[{"id":"CVE-2026-114723","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114723","cwe":"CWE-770","type":"Primary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-114723","date":"2026-10-29","epss":0.00333,"percentile":0.26457}],"urls":["https://bugs.debian.org/1151279","https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f","https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33362e3f04cf","https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114723","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms."}]},{"artifact":{"id":"b6757afb558405cc","cpes":["cpe:2.3:a:libpoppler134:libpoppler134:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"libpoppler134","purl":"pkg:deb/ubuntu/libpoppler134@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpoppler134/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libpoppler134/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libpoppler134:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-9543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-10-29","epss":0.03312,"percentile":0.88531}],"risk":0.1656,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9543"},"relatedVulnerabilities":[{"id":"CVE-2019-9543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-10-29","epss":0.03312,"percentile":0.88531}],"urls":["http://www.securityfocus.com/bid/107238","https://gitlab.freedesktop.org/poppler/poppler/issues/730","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadgenericbitmap-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."}]},{"artifact":{"id":"9a68e14490dec426","cpes":["cpe:2.3:a:poppler-utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler-utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler_utils:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler-utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*","cpe:2.3:a:poppler:poppler_utils:24.02.0-1ubuntu9.11:*:*:*:*:*:*:*"],"name":"poppler-utils","purl":"pkg:deb/ubuntu/poppler-utils@24.02.0-1ubuntu9.11?arch=amd64&distro=ubuntu-24.04&upstream=poppler","type":"deb","version":"24.02.0-1ubuntu9.11","language":"","licenses":["Apache-2.0","GPL-2","GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/poppler-utils/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/poppler-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/poppler-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/poppler-utils.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/poppler-utils.list"}],"upstreams":[{"name":"poppler"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"poppler","version":"24.02.0-1ubuntu9.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-9543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-10-29","epss":0.03312,"percentile":0.88531}],"risk":0.1656,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9543"},"relatedVulnerabilities":[{"id":"CVE-2019-9543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9543","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9543","date":"2026-10-29","epss":0.03312,"percentile":0.88531}],"urls":["http://www.securityfocus.com/bid/107238","https://gitlab.freedesktop.org/poppler/poppler/issues/730","https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadgenericbitmap-poppler-0-74-0/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9543","description":"An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"risk":0.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107209"},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"risk":0.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107209"},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"risk":0.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107209"},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"2caaf637066a5a41","cpes":["cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16-7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16_7t64:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore-6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore_6.q16:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickcore:libmagickcore_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickcore-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickcore-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickcore-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickcore-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"risk":0.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107209"},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"bb7ea65e83d3f781","cpes":["cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16-7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16_7t64:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand-6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand_6.q16:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand-6.q16-7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:libmagickwand:libmagickwand_6.q16_7t64:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"libmagickwand-6.q16-7t64","purl":"pkg:deb/ubuntu/libmagickwand-6.q16-7t64@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/libmagickwand-6.q16-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/libmagickwand-6.q16-7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107209","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107209","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"risk":0.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107209"},"relatedVulnerabilities":[{"id":"CVE-2026-107209","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107209","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107209","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107209","date":"2026-10-29","epss":0.0033,"percentile":0.26092}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/326451aae51ac2dabc99fe66e063de6ec14cf8c8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x","https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107209","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55."}]},{"artifact":{"id":"96b22ec6be3f92c8","cpes":["cpe:2.3:a:imagemagick:imagemagick:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:deb/ubuntu/imagemagick@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-106579","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106579","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106579","cwe":"CWE-551","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106579","date":"2026-10-29","epss":0.00323,"percentile":0.25331}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106579"},"relatedVulnerabilities":[{"id":"CVE-2026-106579","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106579","cwe":"CWE-551","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106579","date":"2026-10-29","epss":0.00323,"percentile":0.25331}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/82f373fedb3425c83a239103ab86f4fa86fd49ac","https://github.com/ImageMagick/ImageMagick/commit/dcdbbf4278fab20a32a4ad80e64cb95c368ca8dd","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vcjj-32hg-qpx5","https://github.com/ImageMagick/ImageMagick6/commit/ac85c8e0a319b1eaf4c3d05d326605f5bae723d6","https://github.com/ImageMagick/ImageMagick6/commit/c54667bfe605ebdc17c23cb70a26dbe00b338222","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106579","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"96b551fd9d61793d","cpes":["cpe:2.3:a:imagemagick-6-common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6-common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6_common:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6-common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6_common:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6-common","purl":"pkg:deb/ubuntu/imagemagick-6-common@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=all&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6-common/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6-common.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6-common.list"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106579","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106579","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106579","cwe":"CWE-551","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106579","date":"2026-10-29","epss":0.00323,"percentile":0.25331}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106579"},"relatedVulnerabilities":[{"id":"CVE-2026-106579","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106579","cwe":"CWE-551","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106579","date":"2026-10-29","epss":0.00323,"percentile":0.25331}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/82f373fedb3425c83a239103ab86f4fa86fd49ac","https://github.com/ImageMagick/ImageMagick/commit/dcdbbf4278fab20a32a4ad80e64cb95c368ca8dd","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vcjj-32hg-qpx5","https://github.com/ImageMagick/ImageMagick6/commit/ac85c8e0a319b1eaf4c3d05d326605f5bae723d6","https://github.com/ImageMagick/ImageMagick6/commit/c54667bfe605ebdc17c23cb70a26dbe00b338222","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106579","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]},{"artifact":{"id":"7ee7cd836e418208","cpes":["cpe:2.3:a:imagemagick-6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_6.q16:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_6.q16:8\\:6.9.12.98\\+dfsg1-5.2build2:*:*:*:*:*:*:*"],"name":"imagemagick-6.q16","purl":"pkg:deb/ubuntu/imagemagick-6.q16@8%3A6.9.12.98%2Bdfsg1-5.2build2?arch=amd64&distro=ubuntu-24.04&upstream=imagemagick","type":"deb","version":"8:6.9.12.98+dfsg1-5.2build2","language":"","licenses":["Artistic","BSD-with-FSF-change-public-domain","GNU-All-Permissive-License","GPL-1","GPL-2","GPL-2+","GPL-3","GPL2+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception","GPL3+-with-Autoconf-Macros-exception-GNU","ImageMagick","ImageMagickLicensePartEZXML","ImageMagickLicensePartFIG","ImageMagickLicensePartGsview","ImageMagickLicensePartOpenSSH","ImageMagickPartGraphicsMagick","ImageMagickPartlibjpeg","ImageMagickPartlibsquish","LGPL-3","LGPL-3+","Magick++","Makefile-in","Perllikelicence","aclocal"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/imagemagick-6.q16/copyright","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/usr/share/doc/imagemagick-6.q16/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.list","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.list"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.postinst","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.postinst"},{"path":"/var/lib/dpkg/info/imagemagick-6.q16.prerm","layerID":"sha256:366cfec4f29287358a01f8b73813ce47d67ee14fe02fa5bacb2298e699427270","accessPath":"/var/lib/dpkg/info/imagemagick-6.q16.prerm"}],"upstreams":[{"name":"imagemagick"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106579","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imagemagick","version":"8:6.9.12.98+dfsg1-5.2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-106579","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-106579","cwe":"CWE-551","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106579","date":"2026-10-29","epss":0.00323,"percentile":0.25331}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-106579"},"relatedVulnerabilities":[{"id":"CVE-2026-106579","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106579","cwe":"CWE-551","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106579","date":"2026-10-29","epss":0.00323,"percentile":0.25331}],"urls":["https://github.com/ImageMagick/ImageMagick/commit/82f373fedb3425c83a239103ab86f4fa86fd49ac","https://github.com/ImageMagick/ImageMagick/commit/dcdbbf4278fab20a32a4ad80e64cb95c368ca8dd","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vcjj-32hg-qpx5","https://github.com/ImageMagick/ImageMagick6/commit/ac85c8e0a319b1eaf4c3d05d326605f5bae723d6","https://github.com/ImageMagick/ImageMagick6/commit/c54667bfe605ebdc17c23cb70a26dbe00b338222","https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106579","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56."}]}],"grade":"F","score":"0.00","as_of":"2026-10-30T15:34:17.915Z","grype_db_version":"2026-10-30T06:23:28.000Z"}