ImageMagick vulnerabilities: known CVEs & security history
ImageMagick · Actively exploited · 72 tracked CVEs · 0 actively exploited · updated August 2026 · what is a CVE? →
This is the full list of known vulnerabilities (CVEs) across all ImageMagick release lines — 72 in total. A CVE here doesn't mean your version is affected — check ImageMagick's current status and the safe version to run.
Known ImageMagick CVEs
Actively-exploited and most-severe first. Open any CVE for full details.
| CVE | Severity | CVSS | EPSS | Year |
|---|---|---|---|---|
| CVE-2026-25965 | high | 8.6 | 1% | 2026 |
| CVE-2026-25794 | high | 8.2 | 0% | 2026 |
| CVE-2026-56379 | high | 8.1 | 1% | 2026 |
| CVE-2026-28693 | high | 8.1 | 0% | 2026 |
| CVE-2026-23876 | high | 8.1 | 1% | 2026 |
| CVE-2026-53461 | high | 7.5 | 0% | 2026 |
| CVE-2026-53460 | high | 7.5 | 0% | 2026 |
| CVE-2026-49218 | high | 7.5 | 0% | 2026 |
| CVE-2026-46522 | high | 7.5 | 2% | 2026 |
| CVE-2026-46520 | high | 7.5 | 0% | 2026 |
| CVE-2026-33908 | high | 7.5 | 1% | 2026 |
| CVE-2026-33901 | high | 7.5 | 1% | 2026 |
| CVE-2026-28691 | high | 7.5 | 0% | 2026 |
| CVE-2026-25985 | high | 7.5 | 1% | 2026 |
| CVE-2026-25968 | high | 7.4 | 0% | 2026 |
| CVE-2026-53466 | medium | 6.5 | 0% | 2026 |
| CVE-2026-53465 | medium | 6.2 | 0% | 2026 |
| CVE-2026-46557 | medium | 6.2 | 0% | 2026 |
| CVE-2026-46523 | medium | 6.2 | 0% | 2026 |
| CVE-2026-55577 | medium | 5.9 | 0% | 2026 |
| CVE-2026-53462 | medium | 5.9 | 0% | 2026 |
| CVE-2026-48994 | medium | 5.9 | 0% | 2026 |
| CVE-2026-47166 | medium | 5.7 | 0% | 2026 |
| CVE-2026-45359 | medium | 5.7 | 0% | 2026 |
| CVE-2026-55597 | medium | 5.5 | 0% | 2026 |
| CVE-2026-55510 | medium | 5.5 | 0% | 2026 |
| CVE-2026-49219 | medium | 5.5 | 0% | 2026 |
| CVE-2026-48734 | medium | 5.5 | 0% | 2026 |
| CVE-2026-48724 | medium | 5.5 | 0% | 2026 |
| CVE-2026-46521 | medium | 5.5 | 0% | 2026 |
| CVE-2026-55594 | medium | 5.3 | 0% | 2026 |
| CVE-2026-53467 | medium | 5.3 | 0% | 2026 |
| CVE-2026-56371 | medium | 5.3 | 0% | 2026 |
| CVE-2026-45664 | medium | 5.3 | 0% | 2026 |
| CVE-2026-45358 | medium | 5.3 | 0% | 2026 |
| CVE-2026-45031 | medium | 5.3 | 0% | 2026 |
| CVE-2026-25969 | medium | 5.3 | 0% | 2026 |
| CVE-2026-45624 | medium | 5.1 | 0% | 2026 |
| CVE-2026-42326 | medium | 5.1 | 0% | 2026 |
| CVE-2025-65955 | medium | 4.9 | 0% | 2025 |
| CVE-2026-55595 | medium | 4.7 | 0% | 2026 |
| CVE-2026-48733 | medium | 4.7 | 0% | 2026 |
| CVE-2026-53463 | medium | 4.3 | 0% | 2026 |
| CVE-2026-47165 | medium | 4.1 | 0% | 2026 |
| CVE-2026-46693 | medium | 4.1 | 0% | 2026 |
| CVE-2026-46692 | medium | 4.1 | 0% | 2026 |
| CVE-2026-53464 | medium | 4 | 0% | 2026 |
| CVE-2026-46559 | medium | 4 | 0% | 2026 |
| CVE-2026-61861 | low | 3.7 | 0% | 2026 |
| CVE-2026-61857 | low | 3.7 | 0% | 2026 |
| CVE-2026-56373 | low | 3.7 | 0% | 2026 |
| CVE-2026-56369 | low | 3.7 | 0% | 2026 |
| CVE-2026-56365 | low | 3.7 | 0% | 2026 |
| CVE-2026-56368 | low | 3.7 | 0% | 2026 |
| CVE-2026-56376 | low | 3.7 | 0% | 2026 |
| CVE-2026-56378 | low | 3.7 | 0% | 2026 |
| CVE-2026-56367 | low | 3.7 | 0% | 2026 |
| CVE-2026-61859 | low | 3.3 | 0% | 2026 |
| CVE-2026-61858 | low | 3.3 | 0% | 2026 |
| CVE-2026-61465 | low | 3.3 | 0% | 2026 |
| CVE-2026-56372 | low | 3.3 | 0% | 2026 |
| CVE-2026-56366 | low | 3.3 | 0% | 2026 |
| CVE-2026-56374 | low | 3.3 | 0% | 2026 |
| CVE-2026-56362 | low | 3.3 | 0% | 2026 |
| CVE-2026-56377 | low | 3.3 | 0% | 2026 |
| CVE-2026-56363 | low | 3.3 | 0% | 2026 |
| CVE-2026-56361 | low | 3.3 | 0% | 2026 |
| CVE-2026-56370 | low | 3.3 | 0% | 2026 |
| CVE-2026-61866 | low | 2.9 | — | 2026 |
| CVE-2026-61863 | low | 2.9 | 0% | 2026 |
| CVE-2026-61870 | low | 2.9 | 0% | 2026 |
| CVE-2026-56364 | low | 1.9 | 0% | 2026 |
Is my ImageMagick version affected?
The list above spans every release. To know whether your version is affected — and the minimum safe version to upgrade to — check it directly.
Check your ImageMagick version → · Monitor ImageMagick for new CVEs →
ImageMagick vulnerabilities — frequently asked
How many known vulnerabilities does ImageMagick have?
IsItPatched tracks 72 CVEs for ImageMagick. 0 are critical-severity and 15 high-severity. These span every release line — what matters is whether the version you run is affected.
Does ImageMagick have any actively-exploited vulnerabilities?
None of ImageMagick's tracked CVEs are currently in CISA's KEV catalog — but new ones can be added at any time, so keep your version current.
What is the most severe ImageMagick vulnerability?
Among tracked issues, CVE-2026-25965 (HIGH, CVSS 8.6) ranks highest — a Path traversal weakness.
Is ImageMagick safe to use?
It depends on the version. The latest supported ImageMagick release clears the known issues; older versions may still be affected. Check the exact version you run for a verdict.
CVE data aggregated from NVD, CISA KEV and EPSS (FIRST.org). Related: ImageMagick security status · ImageMagick end-of-life · actively-exploited CVEs. Always verify against ImageMagick's advisories — see our disclaimer.