USN-8592-1: ImageMagick vulnerabilities

unknownCVE-2026-30936 CVE-2026-30937 CVE-2026-31853 CVE-2026-32259

Hao Ren discovered that ImageMagick incorrectly handled certain images when using the wavelet-denoise operation. An attacker could possibly use this issue to trigger an out-of-bounds heap write, resulting in arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-30936) It was discovered that ImageMagick incorrectly handled extremely large XWD images. An attacker could possibly use this issue to trigger an out-of-bounds heap write, resulting in arbitrary code execution. (CVE-2026-30937) It was discovered that ImageMagick incorrectly handled extremely large SFW images on 32-bit systems. An attacker could possibly use this issue to trigger an integer overflow, resulting in a denial of service. (CVE-2026-31853) It was discovered that ImageMagick incorrectly handled memory allocation failures in the sixel encoder. An attacker could possibly use this issue to trigger a stack buffer overflow, resulting in arbitrary code execution. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-32259)

CSIRTS triage

vendor: ImageMagick product: ImageMagick Remote code execution Denial of service Memory corruptionaffected: affected versions across Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS

What: ImageMagick incorrectly handles certain images during wavelet-denoise operations, extremely large XWD images, and extremely large SFW images on 32-bit systems, allowing out-of-bounds heap writes and integer overflows.
Who is affected: Systems running ImageMagick on Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS that process untrusted images.
Urgency: High urgency due to multiple pathways to arbitrary code execution and denial of service from image processing.
Action: Apply the security update from Ubuntu's package repository (USN-8592-1) to patch ImageMagick to a fixed version.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch ImageMagick

Get an email when a new ImageMagick advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8592-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-309360.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-309370.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-318530.09% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-322590.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-30936	coverage & exploitation status	NVD · CVE.org
CVE-2026-30937	coverage & exploitation status	NVD · CVE.org
CVE-2026-31853	coverage & exploitation status	NVD · CVE.org
CVE-2026-32259	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[UPDATE] [medium] ImageMagick: Multiple vulnerabilitiescert-bund
medium[UPDATE] [medium] ImageMagick: Vulnerability allows unspecified attackcert-bund