USN-8558-1: ImageMagick vulnerabilities

unknownCVE-2025-68950 CVE-2026-28688 CVE-2026-33900 CVE-2026-33905

It was discovered that ImageMagick did not limit mutual references between MVG files. An attacker could possibly use this issue to cause a stack overflow, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-68950) It was discovered that the ImageMagick MSL coder destroyed a cloned image twice when an MSL script failed. An attacker could possibly use this issue to cause a use-after-free, resulting in a denial of service, or arbitrary code execution. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-28688) It was discovered that the ImageMagick VIFF image encoder did not properly validate the packet count, leading to an integer overflow on 32-bit systems. An attacker could possibly use this issue to cause an out-of- bounds heap write, resulting in a denial of service. (CVE-2026-33900) It was discovered that ImageMagick did not properly handle the column offset when sampling an image. An attacker could possibly use this issue to cause ImageMagick to read out of bounds, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-33905)

CSIRTS triage

vendor: null product: ImageMagick Denial of service Memory corruptionOtheraffected: 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS

What: ImageMagick has multiple vulnerabilities that could lead to denial of service or arbitrary code execution.
Who is affected: Users of ImageMagick on the specified Ubuntu LTS versions.
Urgency: Immediate remediation is recommended due to the potential for denial of service and code execution.
Action: Patch ImageMagick to the latest version available for your Ubuntu LTS.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch ImageMagick

Get an email when a new ImageMagick advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-20
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8558-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-689500.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
Low exploitation riskCVE-2026-286880.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
Low exploitation riskCVE-2026-339000.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all scored CVEs.
Low exploitation riskCVE-2026-339050.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-68950	coverage & exploitation status	NVD · CVE.org
CVE-2026-28688	coverage & exploitation status	NVD · CVE.org
CVE-2026-33900	coverage & exploitation status	NVD · CVE.org
CVE-2026-33905	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[UPDATE] [medium] ImageMagick: Multiple vulnerabilitiescert-bund
medium[UPDATE] [medium] ImageMagick: Multiple vulnerabilitiescert-bund
medium[UPDATE] [medium] ImageMagick: Multiple vulnerabilities allow Denial of Servicecert-bund