漏洞公告

ImageMagick: Memory Leak in JNG encoder when a blob could not be opened

ImageMagick: Memory Leak in hough lines operation when an operation fails

ImageMagick: Memory Leak in color transformation to log colorspace when operation fails

ImageMagick: Memory Leak in TIFF encoder when a temporary file could not be created.

ImageMagick: Information Disclosure when printing profiles with debug enabled

ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails

ImageMagick: Use-After-Free when freetype initialization fails

ImageMagick: Policy Bypass in script operation due to missing checks

ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

ImageMagick: Heap-use-after-free via XMP profile could result in a crash

ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797

ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219

ImageMagick: Policy Bypass possible with matrix-backed operations

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

ImageMagick: Policy Bypass in concatenate operation due to missing checks

ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

ImageMagick: Infinite Loop in connected-components when providing invalid arguments

ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`