The remote host has a version of ImageMagick installed that is prior to 6.9.13-44 and 7.x prior to 7.1.2-19. It is, therefore, affected by multiple vulnerabilities:

  - A heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing     a crafted image. (CVE-2026-33901)

  - Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed     recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures,     it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. (CVE-2026-33908)

  - A heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling index.
    (CVE-2026-40310)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

ImageMagick < 6.9.13-44 / 7.x < 7.1.2-19 Multiple Vulnerabilities

high Nessus Plugin ID 306547

Version 1.4