CVE-2026-10677: ImageMagick Postscript Coders Code Injection Vulnerability

Vulnerability Overview Vulnerability Name: Code Injection in the postscript coders Vulnerability Description: Due to certain values not being properly escaped or trimmed, code injection may occur in the output of the postscript coders. Severity: Moderate (5.3 / 10) Scope of Impact Affected Versions: - ImageMagick (C/C++) < 7.1.2-31 - ImageMagick (C/C++) < 6.9.13-56 Remediation Fixed Versions: - ImageMagick (C/C++) 7.1.2-31 - ImageMagick (C/C++) 6.9.13-56 Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVSS v3 Base Metrics String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVE ID: CVE-2026-10677 Credits: - Reporter: takemyh4d - Repository: rvaspolarity Page Links GitHub Advisory: GHSAs-5rg6-j4qq-q892 Publication Date Release Time: 2 weeks ago by diemstra Page Footer Information Copyright: © 2026 GitHub, Inc. Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information Page Top Navigation Navigation Bar: Platform, Solutions, Resources, Open Source, Enterprise, Pricing User Actions: Sign in, Sign up Page Left Navigation Navigation Items: Code, Issues, Pull requests, Discussions, Actions, Security and quality, Insights Page Right Navigation Navigation Items: Security and quality, Insights Page Center Content Title: Code Injection in the postscript coders Description: Because some values are not properly escaped or trimmed it would be possible to inject code in the output of a postscript coder. Page Right Details Severity: Moderate (5.3 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVSS v3 Base Metrics String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVE ID: CVE-2026-10677 Credits: - Reporter: takemyh4d - Repository: rvaspolarity Page Bottom Links Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information Page Top User Actions Actions: Sign in, Sign up Page Left Navigation Navigation Items: Code, Issues, Pull requests, Discussions, Actions, Security and quality, Insights Page Right Navigation Navigation Items: Security and quality, Insights Page Center Content Title: Code Injection in the postscript coders Description: Because some values are not properly escaped or trimmed it would be possible to inject code in the output of a postscript coder. Page Right Details Severity: Moderate (5.3 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVSS v3 Base Metrics String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVE ID: CVE-2026-10677 Credits: - Reporter: takemyh4d - Repository: rvaspolarity Page Bottom Links Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information Page Top User Actions Actions: Sign in, Sign up Page Left Navigation Navigation Items: Code, Issues, Pull requests, Discussions, Actions, Security and quality, Insights Page Right Navigation Navigation Items: Security and quality, Insights Page Center Content Title: Code Injection in the postscript coders Description: Because some values are not properly escaped or trimmed it would be possible to inject code in the output of a postscript coder. Page Right Details Severity: Moderate (5.3 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVSS v3 Base Metrics String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVE ID: CVE-2026-10677 Credits: - Reporter: takemyh4d - Repository: rvaspolarity Page Bottom Links Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information Page Top User Actions Actions: Sign in, Sign up Page Left Navigation Navigation Items: Code, Issues, Pull requests, Discussions, Actions, Security and quality, Insights Page Right Navigation Navigation Items: Security and quality, Insights Page Center Content Title: Code Injection in the postscript coders Description: Because some values are not properly escaped or trimmed it would be possible to inject code in the output of a postscript coder. Page Right Details Severity: Moderate (5.3 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVSS v3 Base Metrics String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-10677: ImageMagick Postscript Coders Code Injection Vulnerability

More from this source