ImageMagick bug bounty programs
imagemagick.org Updated
ImageMagick runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 7
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program ImageMagick runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
ImageMagick
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
7 targets. 5 excluded.
-
https://imagemagick.org
Web
-
Delegate command construction in delegates.xml, the ImageTragick class of shell-injection bug
Products and areas
-
Integer arithmetic on image dimensions, geometry strings and resample kernels, where a wrapped value feeds a later allocation or copy
Products and areas
-
MagickCore in full, including pixel-cache and memory management, the source of a long run of heap overflows
Products and areas
-
The policy.xml and magick.xml security-policy engine itself, where a bypass re-enables every coder an administrator believed they had turned off
Products and areas
-
The project takes reports privately through GitHub private vulnerability reporting on ImageMagick/ImageMagick, and the boundary it draws is the delegate line: defects in third-party binaries such as Ghostscript or libtiff belong to those projects. What follows is ImageMagick's own tree
Products and areas
-
The whole coders/ directory: more than a hundred format readers, each one parsing a different attacker-supplied format
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Bugs in delegated third-party binaries such as Ghostscript or libtiff rather than in ImageMagick itself
-
More than three patch submissions per person per month on the Google pathway
-
One-liner fixes for non-exploitable crashes and resource-exhaustion denial of service, which rules out a large share of raw fuzzer output against this codebase
-
Patches the maintainers decline, and patches older than twelve months or younger than one month at submission
-
The Tier 1 ceiling, which ImageMagick cannot reach: it qualifies at Tier 2 through OSS-Fuzz, not as a named Tier 1 project
Recent changes
Reward and scope changes across every ImageMagick program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in ImageMagick products, from the NVD.
-
CVE-2026-119123 Medium
ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.
-
CVE-2026-119124 Medium
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.
-
CVE-2026-116159 Medium
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.
-
CVE-2026-116160 Medium
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.
-
CVE-2026-116152 Medium
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks that gradually consume process memory.
-
CVE-2026-116153 Low
ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes or potential code execution.
-
CVE-2026-116154 Medium
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.
-
CVE-2026-116155 Medium
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.
About this page
This page gathers every public program listed under imagemagick.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.