JLSEC-2026-976
- Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-976.md
- Import Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-976.json
- JSON Data
- https://api.osv.dev/v1/vulns/JLSEC-2026-976
- Upstream
- Published
- 2026-07-30T16:02:27.435Z
- Modified
- 2026-07-30T18:35:58.062430536Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- ImageMagick has heap use-after-free in the MSL encoder
- Details
-
A heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed.
SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/image.c:1195 in DestroyImage Shadow bytes around the buggy address: 0x0a4e80007450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0a4e80007460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0a4e80007470: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0a4e80007480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0a4e80007490: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0a4e800074a0: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd 0x0a4e800074b0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x0a4e800074c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0a4e800074d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0a4e800074e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0a4e800074f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa - Database specific
{ "license": "CC-BY-4.0", "sources": [ { "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28688", "database_specific": { "status": "Analyzed" }, "modified": "2026-06-17T10:28:54.700Z", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-28688", "imported": "2026-07-30T14:08:45.990Z", "id": "CVE-2026-28688", "published": "2026-03-10T07:43:43.813Z" }, { "html_url": "https://github.com/advisories/GHSA-xxw5-m53x-j38c", "imported": "2026-07-30T14:10:16.302Z", "modified": "2026-03-12T14:11:34Z", "url": "https://api.github.com/advisories/GHSA-xxw5-m53x-j38c", "id": "GHSA-xxw5-m53x-j38c", "published": "2026-03-12T14:11:30Z" }, { "imported": "2026-07-30T14:08:54.368Z", "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-10379", "modified": "2026-03-10T16:02:20Z", "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-10379", "id": "EUVD-2026-10379", "published": "2026-03-09T21:38:08Z" } ] }- References
- Credits
-
-
- ylwango613 - REPORTER
-