ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-94"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106577.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.2-31"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "2ba2edfd04a1ab3d45af4a0dc1e640dde7020192"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "78378cd623468760bee82a5930cb3011725916f8"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "7.1.2-31",
"range": [
{
"fixed": "fb965f1b54a65ddb633f8c2eac4452c782c66d7f"
}
],
"source": "REFERENCES_TAG"
}
]
}
{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.9.13-56"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "879489740daa44dd72e9405b26c845e8aa3d2f53"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d5750d7309ef5a8cd561430d932a183e4168f484"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "6.9.13-56",
"range": [
{
"fixed": "2f16e94c5ecb1256496a20d1ecdcaf53aeb1a4ce"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-106577.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "8089459004440582447803604849093076976",
"length": 24635
},
"id": "CVE-2026-106577-074dd86b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/78378cd623468760bee82a5930cb3011725916f8",
"target": {
"file": "coders/ps2.c",
"function": "WritePS2Image"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"318045265476072046577220490934436149880",
"298165610053186656962732484090741987155",
"324576143648114078500337140639246167750",
"109452957067294852746237030996912161391",
"309708420004694264852328203650785254803"
],
"threshold": 0.9
},
"id": "CVE-2026-106577-1541b42a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/78378cd623468760bee82a5930cb3011725916f8",
"target": {
"file": "coders/ps.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "97010216283792460694661299637361083364",
"length": 24223
},
"id": "CVE-2026-106577-1686b916",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53",
"target": {
"file": "coders/ps2.c",
"function": "WritePS2Image"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"117251525118014525977158238569665513827",
"337498722286000482316178818412244353921",
"15295963595205707487286166202198215447",
"46046718184384303524523471492875276375",
"318045265476072046577220490934436149880",
"298165610053186656962732484090741987155",
"324576143648114078500337140639246167750",
"109452957067294852746237030996912161391",
"309708420004694264852328203650785254803"
],
"threshold": 0.9
},
"id": "CVE-2026-106577-2bdf00bd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/78378cd623468760bee82a5930cb3011725916f8",
"target": {
"file": "coders/ps2.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "262330739271265959775130932947495249078",
"length": 48457
},
"id": "CVE-2026-106577-2f8f25d8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484",
"target": {
"file": "coders/pdf.c",
"function": "WritePDFImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292951211827301154459579439304350005467",
"length": 30731
},
"id": "CVE-2026-106577-671b2cdf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/78378cd623468760bee82a5930cb3011725916f8",
"target": {
"file": "coders/ps.c",
"function": "WritePSImage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"37527199023981923267220266268600643660",
"71382345651377616903479678720938668544",
"153631775350716510433515455752999489484",
"86571095587567642665449454126273144944",
"336520065144377417210750904071986651641",
"236846378929857316644349926965059132127",
"323225351440867076014723316411123562094",
"117677502395732307470031401615765246094",
"64323926764524947031877642715187877593"
],
"threshold": 0.9
},
"id": "CVE-2026-106577-75fe063a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192",
"target": {
"file": "coders/pdf.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115811182292051688517025352786063138643",
"length": 30072
},
"id": "CVE-2026-106577-88b1c075",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53",
"target": {
"file": "coders/ps.c",
"function": "WritePSImage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"116638735235039492882001682139509382290",
"161483625307036529195610100492193929692",
"11003372997847023650207703781467967705",
"264841891619496902705939250893289790811",
"133841505125751001227229391620873903921",
"199844958836115250610919675521256305695",
"50822302804160879955990091704393753161",
"284663664627051825445873679049238993051",
"309708420004694264852328203650785254803"
],
"threshold": 0.9
},
"id": "CVE-2026-106577-9a82b411",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53",
"target": {
"file": "coders/ps2.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"30956934538514781762316671295210339919",
"71653004325660827726757809425089953128",
"15295963595205707487286166202198215447",
"46046718184384303524523471492875276375",
"76385958904248207358960697612106486670",
"176545978030978689874866980913748372321",
"261188084659344298954735996144317680661",
"234227729859161100306373330400907791132",
"265840738521649627501709622184831875327",
"260709028223391540711120398796549144714",
"190341173734329418013638371725239789071",
"287932360914407904502900817979355437397",
"206776846751272075421624788838652125434",
"316177729487086911983644505456326312692",
"84714942639400389580191395434715204509",
"337457775392634348022998555448359243805",
"258081907775664710574106814981944175037",
"7596482903370921942028274235280187393",
"146145523688567075345217786451829176493",
"89507618985517612221110229448752306289",
"121187417880333031174190156455998229983",
"39882512922684995577038073343560343881"
],
"threshold": 0.9
},
"id": "CVE-2026-106577-b0f52da8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/78378cd623468760bee82a5930cb3011725916f8",
"target": {
"file": "coders/ps3.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"140397400329277325231189428160566407719",
"203050411147549866245188442451594963675",
"202895409998180303626999324484425381832",
"317153255782152992383970752329919819751",
"76385958904248207358960697612106486670",
"176545978030978689874866980913748372321",
"261188084659344298954735996144317680661",
"234227729859161100306373330400907791132",
"265840738521649627501709622184831875327",
"260709028223391540711120398796549144714",
"190341173734329418013638371725239789071",
"287932360914407904502900817979355437397",
"206776846751272075421624788838652125434",
"316177729487086911983644505456326312692",
"84714942639400389580191395434715204509",
"337457775392634348022998555448359243805",
"258081907775664710574106814981944175037",
"7596482903370921942028274235280187393",
"146145523688567075345217786451829176493",
"89507618985517612221110229448752306289",
"121187417880333031174190156455998229983",
"39882512922684995577038073343560343881"
],
"threshold": 0.9
},
"id": "CVE-2026-106577-c8c2a834",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53",
"target": {
"file": "coders/ps3.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "204335925393031087659827862598653061242",
"length": 24755
},
"id": "CVE-2026-106577-d7c0e68a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53",
"target": {
"file": "coders/ps3.c",
"function": "WritePS3Image"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "315072785001107856481844738356989124641",
"length": 24832
},
"id": "CVE-2026-106577-e0b6987a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/78378cd623468760bee82a5930cb3011725916f8",
"target": {
"file": "coders/ps3.c",
"function": "WritePS3Image"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"37527199023981923267220266268600643660",
"71382345651377616903479678720938668544",
"166385823291095540379027504863738653310",
"338200263770604384856797734346061810304",
"13128074589690305920949732790162232601",
"82174795330710961340835955652360686237",
"317627971984721246412899222662252171954",
"184224565786055948633500254792075437989"
],
"threshold": 0.9
},
"id": "CVE-2026-106577-ec39a872",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484",
"target": {
"file": "coders/pdf.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"214466592194039422327712001079484875247",
"61317592490386878237554880154288183019",
"274132365001372163450206022288427808187",
"122687221298173006932954108364560114479"
],
"threshold": 0.9
},
"id": "CVE-2026-106577-ef8fbf76",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53",
"target": {
"file": "coders/ps.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "128443887896545958434329560903836027913",
"length": 48688
},
"id": "CVE-2026-106577-ff08e926",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/2ba2edfd04a1ab3d45af4a0dc1e640dde7020192",
"target": {
"file": "coders/pdf.c",
"function": "WritePDFImage"
}
}
]
"2026-10-16T07:22:22Z"