How many CVEs have a located fix in ImageMagick/ImageMagick6?

71 published CVEs have a fix traced to functions in ImageMagick/ImageMagick6, touching 90 functions across 55 files.

Which function in ImageMagick/ImageMagick6 has been patched by the most CVEs?

ReadTIFFImage in coders/tiff.c has been changed by 5 CVE fixes, from 2022 to 2023.

How large is a typical CVE fix in ImageMagick/ImageMagick6?

The median fix changes 7 lines. 77% of fixes change 20 lines or fewer, and 76% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

c

#55 of 500 repositories

ImageMagick/ImageMagick6

Name: ImageMagick/ImageMagick6: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 13, 2026

71

CVE fixes located

Published CVEs

90

Functions patched

Distinct function sites

55

Files patched

Distinct source files

2018–2026

Years covered

By CVE publication date

Overview

71 published CVEs have a fix traced to functions in ImageMagick/ImageMagick6, the earliest published in 2018. Those fixes changed 90 distinct functions across 55 files, in 399 patch hunks.

Among the 500 repositories tracked here, ImageMagick/ImageMagick6 ranks #55 by the number of CVEs with a located fix.

Most patched functions

Functions in ImageMagick/ImageMagick6 changed by the most CVE fixes.

Most patched files

Files in ImageMagick/ImageMagick6 changed by the most CVE fixes.

1coders/tiff.c8 CVEs · 2 functions
2magick/draw.c4 CVEs · 5 functions
3coders/ps.c4 CVEs · 3 functions
4coders/svg.c3 CVEs · 6 functions
5magick/blob.c3 CVEs · 5 functions
6coders/gif.c3 CVEs · 4 functions
7magick/image.c3 CVEs · 3 functions
8coders/png.c3 CVEs · 2 functions
9magick/statistic.c3 CVEs · 2 functions
10coders/pnm.c3 CVEs · 1 functions

Fix size

How much code a CVE fix in ImageMagick/ImageMagick6 changes, with backports counted once.

7

Median lines changed

Added plus removed, per CVE

77%

Fixes of 20 lines or fewer

Share of CVE fixes

76%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in ImageMagick/ImageMagick6, and the functions each fix changed.

ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
CVE-2026-109964DecodeImage
Medium · CVSS 6.3
EPSS 0.4%2026-10-13
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders
CVE-2026-109282GetBlobFileHandle WriteINFOImage WriteJSONImage
Low · CVSS 2.0
EPSS 0.1%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access
CVE-2026-109279SetMagickSecurityPolicy
Low · CVSS 2.0
EPSS 0.1%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation
CVE-2026-109278WaveletDenoiseImage
Medium · CVSS 6.3
EPSS 0.4%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
CVE-2026-109276
Medium · CVSS 6.9
EPSS 0.4%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder
CVE-2026-109275IsValidPostscriptFontname RenderPostscript
Medium · CVSS 6.3
EPSS 0.3%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder
CVE-2026-109273ReadPSInfo
Medium · CVSS 6.9
EPSS 0.3%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder
CVE-2026-109269JPEGSetImageSamplingFactor
Medium · CVSS 6.9
EPSS 0.3%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000
CVE-2026-109268WritePDFImage
Medium · CVSS 6.3
EPSS 0.4%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder
CVE-2026-109267MSLEndElement MSLStartElement
Medium · CVSS 6.9
EPSS 0.4%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via CIP Encoder
CVE-2026-109266WriteCIPImage
Medium · CVSS 6.9
EPSS 0.3%2026-10-12
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder
CVE-2026-109264SVGEndElement ReadImage _ImageInfo
Medium · CVSS 6.3
EPSS 0.4%2026-10-12

Get an alert for each new ImageMagick/ImageMagick6 CVE, with the patched functions and AI-written analysis.

Monitor ImageMagick6 CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

open-webui/open-webui71 CVEs FasterXML/jackson-databind72 CVEs apache/camel73 CVEs bcgit/bc-java73 CVEs php/php-src73 CVEs wordpress/core73 CVEs mintplex-labs/anything-llm69 CVEs glpi-project/glpi67 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in ImageMagick/ImageMagick6.

How many CVEs have a located fix in ImageMagick/ImageMagick6?: 71 published CVEs have a fix traced to functions in ImageMagick/ImageMagick6, touching 90 functions across 55 files.
Which function in ImageMagick/ImageMagick6 has been patched by the most CVEs?: ReadTIFFImage in coders/tiff.c has been changed by 5 CVE fixes, from 2022 to 2023.
How large is a typical CVE fix in ImageMagick/ImageMagick6?: The median fix changes 7 lines. 77% of fixes change 20 lines or fewer, and 76% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track ImageMagick/ImageMagick6 CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing