Source: imagemagick X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for imagemagick. CVE-2026-109258[0]: | ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free | vulnerability in the fx operation that occurs when initialization of | an FX runtime entry fails. Attackers can trigger the failed FX | runtime initialization to cause an invalid free, resulting in memory | corruption and application crashes. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r Fixed by: https://github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323 (7.1.2-32) CVE-2026-109259[1]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an | uninitialized memory read in the TGA image decoder that can expose | memory contents. Attackers can supply a crafted TGA image for | processing to disclose contents of uninitialized memory from the | ImageMagick process. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h499-883p-vph8 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/df199b79f0a1c87ca009e431f03cb387af160f77 (7.1.2-32) Fixed by: https://github.com/ImageMagick/ImageMagick/commit/8e809498fd328256612ee9c0ff7941bd452a0285 (7.1.2-32) CVE-2026-109260[2]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a | memory leak in the PNG encoder, which does not release allocated | memory when libpng initialization fails. Attackers who can | repeatedly trigger PNG encoding operations in which libpng | initialization fails can exhaust memory and cause a denial of | service. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930 (7.1.2-32) CVE-2026-109261[3]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a | memory leak in the GIF encoder because allocated memory is not | released when color quantization fails during encoding. Attackers | can supply images whose GIF conversion causes quantization to fail, | leaking memory with each attempt and degrading availability. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221 (7.1.2-32) CVE-2026-109262[4]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a | memory leak in the SVG encoder (WriteSVGImage) that fails to release | allocated memory when handling crafted images. Attackers can supply | crafted image files that are processed by the SVG encoder to leak | memory and cause a denial of service through resource consumption. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp Fixed by: https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3 (7.1.2-32) CVE-2026-109263[5]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a | memory leak in the YUV encoder, which fails to release allocated | memory when a specific operation fails. Attackers can supply crafted | input that triggers the failing encoder operation, leaking memory | and potentially exhausting resources to cause a denial of service. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2 (7.1.2-32) CVE-2026-109264[6]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains | uncontrolled recursion in the MVG decoder that can exhaust the | program stack. An attacker who controls a file name processed by | ImageMagick can trigger a stack overflow that crashes the process, | causing a denial of service. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c Fixed by: https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20 (7.1.2-32) CVE-2026-109265[7]: | ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read | vulnerability that allows attackers to read beyond allocated memory | due to incorrect string termination in XMP profiles. Attackers can | supply a crafted image containing a malformed XMP profile to trigger | the over-read and crash the application. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg Fixed by: https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7 (7.1.2-32) CVE-2026-109266[8]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML | injection vulnerability in the CIP encoder, which does not properly | escape input-derived data when writing Cisco IP Phone XML output. | Attackers can supply a crafted file that, when converted to CIP | format, injects arbitrary markup into the generated XML. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3429-f84m-8qhw Fixed by: https://github.com/ImageMagick/ImageMagick/commit/45bb7328b36c163234f5ccb7f1d494b7c4c8c775 (7.1.2-32) CVE-2026-109267[9]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a | stack overflow in the MSL decoder caused by an incorrect depth check | that fails to limit recursion. Attackers can supply a set of crafted | MSL images that exhaust the stack when one of them is read, crashing | the process and causing a denial of service. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683 (7.1.2-32) CVE-2026-109268[10]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use | after free vulnerability in the PDF writer when writing CMYK images | with JPEG2000 compression. Attackers can supply a crafted CMYK image | that, when written to PDF with JPEG2000 compression, causes freed | memory to be reused, potentially crashing the process. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv Fixed by: https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54 (7.1.2-32) CVE-2026-109269[11]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an | information disclosure vulnerability in the JPEG decoder, which | performs a read that exposes uninitialized memory when handling | crafted input. Attackers can supply a crafted JPEG file for | processing to disclose uninitialized memory contents. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxrx-rjp3-27rj Fixed by: https://github.com/ImageMagick/ImageMagick/commit/aa104ff2e408bea23828e7a7a346f9080da4104b (7.1.2-32) CVE-2026-109270[12]: | ImageMagick before 7.1.2-32 contains a memory leak vulnerability in | the -process option that allows attackers to cause unreleased memory | allocations by supplying certain arguments. Attackers can repeatedly | invoke the -process option with crafted arguments to gradually | exhaust memory and degrade service availability. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f32c-2v6j-wvh5 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/da4cfd78a2ceea4cf54207834f9d60c1b9c38797 (7.1.2-32) CVE-2026-109271[13]: | ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free | vulnerability in the WBINFO decoder that occurs when a memory | allocation fails during image decoding. Attackers can supply a | crafted image that, when decoded under memory allocation failure | conditions, causes freed memory to be reused, crashing the | application. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x Fixed by: https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4 (7.1.2-32) Fixed by: https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6 (7.1.2-32) CVE-2026-109272[14]: | ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer | dereference in the PostScript decoder that is triggered when a | policy limit is reached. Attackers can supply a crafted PostScript | file for processing to crash the application, causing a denial of | service. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722 (7.1.2-32) CVE-2026-109273[15]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an | information disclosure vulnerability in the PostScript decoder, | which allocates a buffer one byte longer than the data it decoded. | Attackers can supply a crafted PostScript file to expose a single | uninitialized byte of memory contents. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5j8x-vq8c-vrp9 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/5a5c2e51948fcc5d85b8d832938e2c1b4db4a699 (7.1.2-32) CVE-2026-109274[16]: | ImageMagick before 7.1.2-32 contains a time-of-check time-of-use | symlink race vulnerability that allows attackers to bypass the path | security policy when executing a magick script. Attackers can swap a | checked path with a symlink during script execution to read files | that the security policy is meant to block. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7q74-r26w-fwcx Fixed by: https://github.com/ImageMagick/ImageMagick/commit/9e789499e67dbf5c4ee9fe1b72690738c799ec73 (7.1.2-32) CVE-2026-109275[17]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code | injection vulnerability in the MVG decoder when a PostScript | renderer is used. Attackers can supply a crafted MVG file that, when | decoded, injects code into the PostScript rendering path. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226 (7.1.2-32) CVE-2026-109276[18]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an | incomplete cleanup flaw in the JNG decoder that fails to remove | temporary files when processing crafted input. Attackers can submit | crafted JNG files for processing to repeatedly leak temporary files, | consuming disk space and degrading availability. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r Fixed by: https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a (7.1.2-32) CVE-2026-109277[19]: | ImageMagick before 7.1.2-32 contains a policy bypass vulnerability | in the -script operation due to missing checks on file descriptor | handling. Attackers can use the -script operation to close file | descriptors not opened by the current operation, circumventing | configured security policies. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vv56-wmgw-m36w Fixed by: https://github.com/ImageMagick/ImageMagick/commit/ce92ae07c2ca2c20c131eaf6da6da734c1cafce0 (7.1.2-32) CVE-2026-109278[20]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a | memory leak in the wavelet-denoise operation, which fails to release | allocated memory when a required resource cannot be acquired. | Attackers can repeatedly trigger wavelet-denoise processing under | resource-constrained conditions to leak memory and degrade service | availability. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c Fixed by: https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c (7.1.2-32) CVE-2026-109279[21]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper | synchronization when the security policy is accessed, so | simultaneous reads and writes of the policy by multiple threads | trigger a race condition that causes a heap buffer over-write. An | attacker able to induce concurrent security policy access can crash | the application, causing a denial of service. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8x3v-wr32-qqh4 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/12db6f04e895deae4537ead10c771a244607794a (7.1.2-32) CVE-2026-109280[22]: | ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free | vulnerability in the -fx option that occurs when a memory allocation | fails during a specific operation. Attackers who can supply crafted | -fx expressions under memory pressure can trigger freed memory | access, causing crashes or memory corruption. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v2x3-wpmg-c4w6 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/fb743d60700c9bc350c3d2a0b48b998bdabc466c (7.1.2-32) CVE-2026-109281[23]: | ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over- | read in its handling of the -fx option, where a certain -fx | operation reads beyond the bounds of an allocated heap buffer in | specific situations. Attackers who can get a crafted -fx expression | processed can read out-of-bounds heap memory, potentially disclosing | limited memory contents. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvgp-q487-j22w Fixed by: https://github.com/ImageMagick/ImageMagick/commit/0e82a4d0b294581186ed7b3e1dce59c858a73dba (7.1.2-32) CVE-2026-109282[24]: | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type | confusion flaw in the INFO, JSON and YAML encoders, where an | internal method receives a pointer of an unexpected type when | writing an image in a compressed format. An attacker who can cause | such an image write can trigger a SIGABRT or SIGSEGV, crashing the | process and causing denial of service. https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8xmr-6q99-c4x8 Fixed by: https://github.com/ImageMagick/ImageMagick/commit/af7b85012e62fa65393277790b96c56a98d882b6 (7.1.2-32) If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-109258 https://www.cve.org/CVERecord?id=CVE-2026-109258 [1] https://security-tracker.debian.org/tracker/CVE-2026-109259 https://www.cve.org/CVERecord?id=CVE-2026-109259 [2] https://security-tracker.debian.org/tracker/CVE-2026-109260 https://www.cve.org/CVERecord?id=CVE-2026-109260 [3] https://security-tracker.debian.org/tracker/CVE-2026-109261 https://www.cve.org/CVERecord?id=CVE-2026-109261 [4] https://security-tracker.debian.org/tracker/CVE-2026-109262 https://www.cve.org/CVERecord?id=CVE-2026-109262 [5] https://security-tracker.debian.org/tracker/CVE-2026-109263 https://www.cve.org/CVERecord?id=CVE-2026-109263 [6] https://security-tracker.debian.org/tracker/CVE-2026-109264 https://www.cve.org/CVERecord?id=CVE-2026-109264 [7] https://security-tracker.debian.org/tracker/CVE-2026-109265 https://www.cve.org/CVERecord?id=CVE-2026-109265 [8] https://security-tracker.debian.org/tracker/CVE-2026-109266 https://www.cve.org/CVERecord?id=CVE-2026-109266 [9] https://security-tracker.debian.org/tracker/CVE-2026-109267 https://www.cve.org/CVERecord?id=CVE-2026-109267 [10] https://security-tracker.debian.org/tracker/CVE-2026-109268 https://www.cve.org/CVERecord?id=CVE-2026-109268 [11] https://security-tracker.debian.org/tracker/CVE-2026-109269 https://www.cve.org/CVERecord?id=CVE-2026-109269 [12] https://security-tracker.debian.org/tracker/CVE-2026-109270 https://www.cve.org/CVERecord?id=CVE-2026-109270 [13] https://security-tracker.debian.org/tracker/CVE-2026-109271 https://www.cve.org/CVERecord?id=CVE-2026-109271 [14] https://security-tracker.debian.org/tracker/CVE-2026-109272 https://www.cve.org/CVERecord?id=CVE-2026-109272 [15] https://security-tracker.debian.org/tracker/CVE-2026-109273 https://www.cve.org/CVERecord?id=CVE-2026-109273 [16] https://security-tracker.debian.org/tracker/CVE-2026-109274 https://www.cve.org/CVERecord?id=CVE-2026-109274 [17] https://security-tracker.debian.org/tracker/CVE-2026-109275 https://www.cve.org/CVERecord?id=CVE-2026-109275 [18] https://security-tracker.debian.org/tracker/CVE-2026-109276 https://www.cve.org/CVERecord?id=CVE-2026-109276 [19] https://security-tracker.debian.org/tracker/CVE-2026-109277 https://www.cve.org/CVERecord?id=CVE-2026-109277 [20] https://security-tracker.debian.org/tracker/CVE-2026-109278 https://www.cve.org/CVERecord?id=CVE-2026-109278 [21] https://security-tracker.debian.org/tracker/CVE-2026-109279 https://www.cve.org/CVERecord?id=CVE-2026-109279 [22] https://security-tracker.debian.org/tracker/CVE-2026-109280 https://www.cve.org/CVERecord?id=CVE-2026-109280 [23] https://security-tracker.debian.org/tracker/CVE-2026-109281 https://www.cve.org/CVERecord?id=CVE-2026-109281 [24] https://security-tracker.debian.org/tracker/CVE-2026-109282 https://www.cve.org/CVERecord?id=CVE-2026-109282 Please adjust the affected versions in the BTS as needed.
