CVE-2026-55510

Summary

ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

Severity

medium

CVSS

5.5

EPSS

0.1% (p4)

CWE

CWE-416

Also known as

GHSA-ff5c-8x9r-8qcw#Magick.NET-Q16-AnyCPU

Published

2026-07-24

Updated

2026-07-24

Advisory details

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

References

• https://github.com/advisories/GHSA-ff5c-8x9r-8qcw
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-ff5c-8x9r-8qcw
• https://nvd.nist.gov/vuln/detail/CVE-2026-55510
• https://github.com/dlemstra/Magick.NET/releases/tag/14.15.0

Related advisories

• CVE-2026-53462 — medium · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-53461 — high · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-53460 — high · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-49218 — high · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-46522 — high · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-46520 — high · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-33901 — high · NuGet/Magick.NET-Q16-AnyCPU
• CVE-2026-33908 — high · NuGet/Magick.NET-Q16-AnyCPU

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity