JLSEC-2026-851

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-851.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-851.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-851

Upstream

CVE-2020-27753

Published

2026-07-30T16:02:27.435Z

Modified

2026-07-30T18:23:45.369146863Z

Severity

4.3 (Medium) CVSS_V2 - AV:N/AC:M/Au:N/C:N/I:N/A:P CVSS Calculator
5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file. These leaks could potentially lead to an impact to application availability or cause a denial of service. It was originally reported that the issues were in AcquireMagickMemory() because that is where LeakSanitizer detected the leaks, but the patch resolves issues in the MIFF coder, which incorrectly handles data being passed to AcquireMagickMemory(). This flaw affects ImageMagick versions prior to 7.0.9-0.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27753",
            "database_specific": {
                "status": "Modified"
            },
            "modified": "2026-06-17T03:09:34.680Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-27753",
            "imported": "2026-07-30T14:08:42.523Z",
            "id": "CVE-2020-27753",
            "published": "2020-12-08T22:15:18.133Z"
        }
    ]
}

References

Affected packages

Julia / ImageMagick_jll

Package

Name: ImageMagick_jll
Purl: pkg:julia/ImageMagick_jll?uuid=c73af94c-d91f-53ed-93a7-00f77d67a9d7

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.9.12+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-851.json"