When you save a record edit, Poweradmin checks whether you're allowed to touch the record by looking at a zone id you send in the POST body, but it then applies the change to a record id you also send in the POST body. Nothing checks that the record id actually belongs to that zone id. So you point the permission check at a zone you legitimately own, point the …
The REST API user-update endpoint (PUT/PATCH /api/v2/users/{id} and the V1 equivalent) does not enforce two authorization rules that the web interface enforces. A user who holds the user_edit_others permission but is not a superuser can: edit user accounts that belong to a superuser, and set the password of any account, even without the user_passwd_edit_others permission. Because of this, a non-admin "user manager" role can send a single API request that …
Disclosure of the contents of arbitrary .map files reachable via path traversal (or absolute path when from is unset) from the process's filesystem. Affects any application processing CSS it does not fully trust without explicitly passing map: false. No authentication or user interaction beyond submitting CSS text is required.
pheditor's terminal feature restricts callers to an allowlist of commands (TERMINAL_COMMANDS) and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their own options (find, git, php, tar, grep). A caller can therefore run any command using only allowlisted binaries and no rejected metacharacter, escaping the allowlist restriction the terminal feature relies on.
The forced password-change flow, triggered when the stored password is still the default (admin), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditor_password is enough to reach the password-change form, and submitting pheditor_new_password / pheditor_confirm_password in the same request is enough to set an arbitrary new password and obtain an authenticated session — without ever proving knowledge of the …
An authorization bypass and information disclosure vulnerability exists in the search API of Openlist. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned BasePath restrictions to discover and access metadata of files residing in unauthorized sibling directories.
The /api/fs/batch_rename handler validates and authorizes only the requested source directory. It rejects path separators in new_name, but it does not validate src_name. The handler concatenates src_dir and attacker-controlled src_name, then passes the result to the filesystem rename layer, where the path is normalized. An authenticated user with rename permission can set src_name to traversal segments such as ../../ab/secret.txt. When the user's base path is /team/a and src_dir is /writable, …
An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.
The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and …
When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIED_AUTH privilege and never evaluated the "proxy" access-control right (the mayProxy ACI scope check). As a result, any account holding the proxied-auth privilege could assume any resolvable non-root identity without being granted a proxy ACI for that target. This diverges from every other proxy path in OpenDJ — the proxied-authorization …
The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth > 1. Because the Java serialization filter is consulted for every class in the graph (and depth == 1 only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked.
A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (/authservice, PLL) accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is reachable without authentication and allows an attacker to run code on the server.
The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript in the OpenAM origin. This is the same vulnerability class as CVE-2026-44203; that fix did not cover this code path.
The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/open_webui/routers/terminals.py documents _sanitize_proxy_path() as decoding until stable, but the implementation stops after 8 unquote() passes. A 9x percent-encoded ../… path parameter remains once-encoded after the loop, passes the posixpath.normpath() and cleaned.startswith('..') checks, and is forwarded to the configured terminal server. The upstream server then receives a decoded traversal path such as /base/../admin/system.
Open WebUI's file upload background processing trusts the client-supplied metadata.knowledge_id value and inserts a knowledge_file association before validating that the uploading user has write access to the target knowledge base. A verified user with only read access to a knowledge base can upload an arbitrary file and set metadata={"knowledge_id":"<target knowledge id>"}. The normal /api/v1/knowledge/{id}/file/add endpoint correctly requires knowledge-base write access, but the upload auto-link path bypasses that authorization check. The …
The Socket.IO server is configured with always_connect=True (lines 78, 91 in backend/open_webui/socket/main.py) and the connect handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions.
The terminal proxy in backend/open_webui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is attacker-influenceable on both proxy paths: HTTP path (proxy_terminal) sets headers['X-User-Id'] = user.id. Upstreams that trust X-User-Id as identity receive it unsigned, so an attacker who can reach the upstream by other means (directly, …
Open WebUI runs client-side Python (Pyodide) in a same-origin web worker. Through Pyodide's JavaScript API (pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest) executed Python can issue requests on the application origin, and those requests carry the victim's session cookie. A low-privileged user can store such a payload in a chat message, share the chat, and when a victim opens it and clicks Run the payload …
Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with get_verified_user() (which rejects pending), while automation create/update/run routes additionally require the features.automations permission. Two paths missed that lifecycle gate, so a deactivated (pending) account could keep acting through the background automation scheduler: Scheduler did not re-gate the owner. When a stored automation became due, execute_automation() rehydrated the owner …
Two regexes in backend/open_webui/utils/middleware.py that parse <$skillId|label> skill-mention tags backtrack in O(n²) on input that contains <$ followed by a long run with no closing >. Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one such input pins a CPU core inside re and freezes the entire instance for all users until the …
With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout (per-token jti) and OIDC back-channel logout (per-user revoked_at) record revocations in Redis, and HTTP auth (get_current_user) rejects revoked tokens with 401. The realtime authentication surfaces do not perform this check: Socket.IO connect / user-join / join-channels / join-note and the terminal websocket first-message auth validate tokens with decode_token() only (signature + expiry). A JWT revoked by sign-out or back-channel logout …
A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/{id}/messages/{message_id}/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without verifying the parent belongs to that channel. By requesting a thread in a channel they can access while supplying a victim channel's message id as the …
POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in edit_image tool, and the chat image-edit middleware — but the direct edit route enforced neither. A verified non-admin user could therefore invoke server-side image editing, reaching the configured image-edit provider with the administrator's credentials, even when the …
Current main and v0.9.6 still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model. This is an incomplete-fix variant of GHSA-vjqm-6gcc-62cr. The current fix adds _verify_knowledge_file_access(), but the validator only checks has_access_to_file(file_id, "read", user). The file write/delete routes later trust has_access_to_file(file_id, "write", user), and that function grants access through any writable model whose meta.knowledge …
The get_all_models handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of key_builder=. In aiocache 0.12.3 (the pinned version), key= is a static cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided …
An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller (get_event_call) delivers execute:python / execute:tool events to a client-supplied session_id after only checking that the session is connected, never that it belongs to the requester. Combined with ydoc:document:join, which exposes the live socket ids of everyone in a shared note's collaboration room to any read-access participant, an attacker can target a …
Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This advisory consolidates two filings of the same flaw: …
An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate_chat_completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass_filter=True, skipping the selected …
The /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The expensive bcrypt comparison therefore made valid-account attempts respond significantly slower (~180 ms) than non-existent ones (~5 ms), so an unauthenticated attacker could enumerate valid accounts by measuring response …
The administrator-configured WEB_FETCH_FILTER_LIST (the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch) matches hostnames incorrectly, so the filter can be bypassed.
The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (settings.ui.toolServers[].key), which is not available via standard user info APIs.
Heap-buffer-overflow READ (16 bytes) in Gemm_7_6::adapt_gemm_7_6() (onnx/version_converter/adapters/gemm_7_6.h:41) when ConvertVersion() processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses B_shape[1] without checking rank. On Release builds the OOB read is silent; ASan confirms 16-byte read past a 48-byte allocation.
Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject ANSI/OSC escape sequences that the victim's terminal executes on every prompt render. (This is separate from the path-segment command-execution report; it has a different root cause and fix.)
Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go text/template engine. That engine's function map exposes a cmd function that runs arbitrary OS commands. A directory whose name contains a Go template expression is therefore evaluated when the prompt renders, giving arbitrary command execution as the current user as soon as the shell is inside (or below) that …
node-tar (npm tar) contains an uncontrolled-recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. When a consumer calls tar.t(…) or tar.x(…) with a non-empty member-selection list, node-tar installs a filter that closes over the recursive mapHas (src/list.ts:33-44). mapHas walks an entry path upward one path.dirname() call per recursion with no segment cap. A single crafted tar with a GNU-L (or PAX-x) long-path header can deliver a path of …
A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service.
An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated </ characters) to a Netty server utilizing XmlFrameDecoder, causing the server's EventLoop thread to exhaust CPU resources and become unresponsive.
What kind of vulnerability is it? Who is impacted? Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOne(filter, req.body), can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype. Example: const mongoose = require('mongoose'); console.log('before:', Object.prototype.$fullPath); // undefined const User = mongoose.model('User', new mongoose.Schema({ name: String })); const malicious = JSON.parse('{"$set": {"proto.x": "anything"}}'); // attacker-controlled update const q = User.updateOne({}, {}); try { q._castUpdate(malicious); …
Kiota versions prior to 1.32.3 and 1.29.1 are affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# …
Kiota versions prior to 1.32.3 and 1.29.1 are affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# …
kiota plugin add / kiota plugin generate (with -t APIPlugin) emits an attacker-controlled static_template.file path from the AI-plugin extensions (x-ai-adaptive-card, x-ai-capabilities) verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (<name>-apiplugin.json). An attacker-controlled or compromised OpenAPI description can therefore embed a ../ / absolute path into the manifest's response_semantics.static_template.file, yielding a path traversal (CWE-22) / out-of-package file inclusion (CWE-829) that is resolved by the …
kiota plugin add / kiota plugin generate (with -t APIPlugin) emits an attacker-controlled static_template.file path from the AI-plugin extensions (x-ai-adaptive-card, x-ai-capabilities) verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (<name>-apiplugin.json). An attacker-controlled or compromised OpenAPI description can therefore embed a ../ / absolute path into the manifest's response_semantics.static_template.file, yielding a path traversal (CWE-22) / out-of-package file inclusion (CWE-829) that is resolved by the …
Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics static_template (or the adaptive-card extension x-ai-adaptive-card), the file reference is written into the generated manifest's response_semantics.static_template.file and is later resolved by the AI host relative to the plugin package. An attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package …
Microsoft Kiota resolved OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on 1.32.3 / 1.32.4.
Microsoft Kiota resolved OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on 1.32.3 / 1.32.4.
kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand (and dependency name/version) as the tool's own recommended install command, replacing kiota's normally-trusted suggestion. With an attacker-controlled or compromised description: $ kiota info -d <attacker-spec> -l CSharp … Hint: use the install command to install the dependencies. Example: curl …
kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand (and dependency name/version) as the tool's own recommended install command, replacing kiota's normally-trusted suggestion. With an attacker-controlled or compromised description: $ kiota info -d <attacker-spec> -l CSharp … Hint: use the install command to install the dependencies. Example: curl …
Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution
Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution
Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module …
Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module …
The Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields (e.g. description, default values, and property names) directly into PHP double-quoted string literals without properly escaping the $ character. Since PHP evaluates string interpolation expressions like "${expr}", "$var", and "{$obj->prop}" within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary PHP code …
The Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields (e.g. description, default values, and property names) directly into PHP double-quoted string literals without properly escaping the $ character. Since PHP evaluates string interpolation expressions like "${expr}", "$var", and "{$obj->prop}" within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary PHP code …
Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/–class-name — the zero-config workflow that x-ms-kiota-info is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with …
Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/–class-name — the zero-config workflow that x-ms-kiota-info is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with …
Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository (or pull request) containing a malicious per-client / per-plugin outputPath causes Kiota, when a developer or CI runs the documented regenerate command, to (CWE-22) write the entire generated client to an arbitrary path outside the workspace — …
Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository (or pull request) containing a malicious per-client / per-plugin outputPath causes Kiota, when a developer or CI runs the documented regenerate command, to (CWE-22) write the entire generated client to an arbitrary path outside the workspace — …
Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte array object or the off / len arguments passed to affected XXHash APIs. It does not affect the common case where only the contents of a …
Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte array object or the off / len arguments passed to affected XXHash APIs. It does not affect the common case where only the contents of a …
The pop array filter at src/filters/array.ts:91-95 allocates a full clone of its input array via […toArray(v)] but does not call this.context.memoryLimit.use(…) the way every other array-clone filter in the same file does (shift, unshift, compact, concat, reverse, sample, slice, map, sortBy, where, group_by, uniq). This silently disables the memoryLimit budget for {{ huge_array | pop }}, letting a template render allocate an O(N) clone of an attacker-influenced array regardless of …
The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop to block indefinitely. This affects the default new_host() configuration and requires no special setup on either side.
Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters. Encoded path traversal segments can cause the upstream URL to resolve to a different Kubernetes API endpoint after authorization.
ValidationHandler.Load() in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application …
openapi3filter.ValidateRequest contains a NULL-pointer-dereference denial of service: any unauthenticated client can crash the request-validation path with a single HTTP request. When an operation declares a content parameter (as opposed to a schema parameter) whose media type object has no schema, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi's own doc.Validate() accepts it — and the defect affects both OpenAPI 3.0.x …
Parsing a small YAML document can take exponential time. An application that calls load() or loadAll() on untrusted input can be hung by a payload under 200 bytes.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When the freetype initialization fails the method does not exit and uses memory that was freed.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
A memory leak will occur when a blob cannot be opened in the YUV decoder.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
When an allocation fails in the VIFF encoder a memory leak will occus.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When an allocation fails in the TIFF encoder a small memory leak will occur.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
When a temporary file can not be created a small memory leak will happen in the TIFF encoder.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
A memory leak will occur in the MIFF encoder when an allocation fails.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
When a blob can not be opened a memory leak will occur when encoding a JNG file.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
A memory leak will occur in the ICON decoder when an allocation fails.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When a specific operation fails in the hough lines operation a small memory leak will occur.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When transforming an image to the log colorspace a small memory leak happens when the operation fails.
When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.
When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.
When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.
When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.
When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.
When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
When providing invalid arguments to the connected-components option an infinite loop will occur.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
Running an X11 import with a crafted window title can result in a heap buffer over-write.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
A heap buffer over-write can occur in the fx operation by passing a crafted argument.
A heap buffer over-write can occur in the fx operation by passing a crafted argument.
A heap buffer over-write can occur in the fx operation by passing a crafted argument.