CVE-2026-109263

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.(CVE-2026-105081)

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.(CVE-2026-109258)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.(CVE-2026-109259)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.(CVE-2026-109260)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.(CVE-2026-109261)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.(CVE-2026-109262)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.(CVE-2026-109263)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.(CVE-2026-109264)

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.(CVE-2026-109265)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.(CVE-2026-109266)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of…

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.(CVE-2026-105081)

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.(CVE-2026-109258)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.(CVE-2026-109259)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.(CVE-2026-109260)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.(CVE-2026-109261)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.(CVE-2026-109262)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.(CVE-2026-109263)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.(CVE-2026-109264)

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.(CVE-2026-109265)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.(CVE-2026-109266)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of…

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.(CVE-2026-105081)

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.(CVE-2026-109258)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.(CVE-2026-109259)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.(CVE-2026-109260)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.(CVE-2026-109261)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.(CVE-2026-109262)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.(CVE-2026-109263)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.(CVE-2026-109264)

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.(CVE-2026-109265)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.(CVE-2026-109266)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of…

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.(CVE-2026-105081)

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.(CVE-2026-109258)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.(CVE-2026-109259)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.(CVE-2026-109260)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.(CVE-2026-109261)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.(CVE-2026-109262)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.(CVE-2026-109263)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.(CVE-2026-109264)

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.(CVE-2026-109265)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.(CVE-2026-109266)

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of…

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.

• SECURITY UPDATE: infinite loop in the XML parser via parameter entities
  • debian/patches/CVE-2026-106568.patch: also check parameter entity ('%') references for circular declarations in ValidateEntities() and ParseInternalDoctype() in magick/xml-tree.c
  • CVE-2026-106568
• SECURITY UPDATE: uninitialized memory read in the TGA decoder
  • debian/patches/CVE-2026-109259.patch: zero-initialize the TGA header in ReadTGAImage() in coders/tga.c
  • CVE-2026-109259
• SECURITY UPDATE: memory leak in the YUV encoder
  • debian/patches/CVE-2026-109263.patch: release the resized image when the chroma resize fails, and the chroma image when the scene loop exits early, in WriteYUVImage() in coders/yuv.c
  • CVE-2026-109263
• SECURITY UPDATE: PostScript code injection through font names
  • debian/patches/CVE-2026-109275.patch: only pass font names made of alphanumerics, '-', '_' and '.' to the PostScript renderer, otherwise fall back to Times-Roman, in RenderPostscript() in magick/annotate.c
  • CVE-2026-109275
• SECURITY UPDATE: memory leak in wavelet denoise
  • debian/patches/CVE-2026-109278.patch: release the output image on the resource and memory allocation failure paths in WaveletDenoiseImage() in magick/fx.c
  • CVE-2026-109278

• SECURITY UPDATE: infinite loop on circular parameter entities
  • debian/patches/CVE-2026-106568.patch: check entity values for both '%' and '&' references in ValidateEntities() so circular parameter entity declarations are rejected in ParseInternalDoctype() in magick/xml-tree.c
  • CVE-2026-106568
• SECURITY UPDATE: memory leak in the YUV encoder
  • debian/patches/CVE-2026-109263.patch: destroy the luma image when the chroma ResizeImage() fails and destroy the chroma image after the encoding loop in WriteYUVImage() in coders/yuv.c
  • CVE-2026-109263
• SECURITY UPDATE: PostScript code injection through the font name
  • debian/patches/CVE-2026-109275.patch: only pass font names made of alphanumerics, '-', '_' and '.' to the PostScript renderer in RenderPostscript() in magick/annotate.c
  • CVE-2026-109275

These are all security issues fixed in the ImageMagick-7.1.2.34-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ImageMagick fixes the following issues:

• CVE-2026-93586: use-after-free in the ImagesToBlob method can lead to a process crash (bsc#1281912).
• CVE-2026-106565: a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop (bsc#1284662).
• CVE-2026-106567: a crafted PSD file can trigger an integer-conversion error in the PSD decoder, causing an infinite loop and DoS (bsc#1284664).
• CVE-2026-106568: a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop (bsc#1284665).
• CVE-2026-106571: a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process (bsc#1284668).
• CVE-2026-106572: a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process (bsc#1284669).
• CVE-2026-106577: unescaped or untrimmed values can inject code into output generated by PostScript coders (bsc#1284675).
• CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read (bsc#1284678).
• CVE-2026-106580: a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash (bsc#1284680).
• CVE-2026-107208: a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process (bsc#1284681).
• CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause a crash (bsc#1284682).
• CVE-2026-107210: a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit (bsc#1284683).
• CVE-2026-109259: Information disclosure via crafted TGA image (bsc#1285071).
• CVE-2026-109260: Denial of Service via memory leak in PNG encoder (bsc#1285071).
• CVE-2026-109261: Denial of Service via memory leak in GIF encoder (bsc#1285071).
• CVE-2026-109262: Denial of Service via memory leak in SVG encoder (bsc#1285071).
• CVE-2026-109263: Denial of Service via memory leak in YUV encoder (bsc#1285071).
• CVE-2026-109266: XML injection vulnerability in the CIP encoder (bsc#1285071).
• CVE-2026-109269: Information disclosure via crafted JPEG file (bsc#1285071).
• CVE-2026-109273: Information disclosure via crafted PostScript file (bsc#1285071).
• CVE-2026-109275: Code injection via crafted MVG file (bsc#1285071).
• CVE-2026-109276: Denial of Service via temporary file leak in JNG decoder (bsc#1285071).

This update for ImageMagick fixes the following issues:

• CVE-2026-93586: use-after-free in the ImagesToBlob method can lead to a process crash (bsc#1281912).
• CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a denial of service (bsc#1281909).
• CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
• CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
• CVE-2026-105083: security policy not applied when a user changes the DOCTYPE in the policy.xml file to something else that is valid xml (bsc#1284217).
• CVE-2026-106565: a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop (bsc#1284662).
• CVE-2026-106566: delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file with random data (bsc#1284663).
• CVE-2026-106567: a crafted PSD file can trigger an integer-conversion error in the PSD decoder, causing an infinite loop and DoS (bsc#1284664).
• CVE-2026-106568: a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop (bsc#1284665).
• CVE-2026-106570: an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing a DoS (bsc#1284667).
• CVE-2026-106571: a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process (bsc#1284668).
• CVE-2026-106572: a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process (bsc#1284669).
• CVE-2026-106573: a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long- running operation (bsc#1284671).
• CVE-2026-106574: a client connected to the distributed pixel cache server can send crafted pixel data that triggers a heap buffer overwrite and crash the server (bsc#1284672).
• CVE-2026-106575: a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors (bsc#1284673).
• CVE-2026-106577: unescaped or untrimmed values can inject code into output generated by PostScript coders (bsc#1284675).
• CVE-2026-106578: a crafted image can cause an invalid memory free in the MVG decoder and crash the process (bsc#1284677).
• CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read (bsc#1284678).
• CVE-2026-106580: a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash (bsc#1284680).
• CVE-2026-107208: a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process (bsc#1284681).
• CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause a crash (bsc#1284682).
• CVE-2026-107210: a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit (bsc#1284683).
• CVE-2026-109259: Information disclosure via crafted TGA image (bsc#1285071).
• CVE-2026-109260: Denial of Service via memory leak in PNG encoder (bsc#1285071).
• CVE-2026-109261: Denial of Service via memory leak in GIF encoder (bsc#1285071).
• CVE-2026-109262: Denial of Service via memory leak in SVG encoder (bsc#1285071).
• CVE-2026-109263: Denial of Service via memory leak in YUV encoder (bsc#1285071).
• CVE-2026-109266: XML injection vulnerability in the CIP encoder (bsc#1285071). -…