CVE-2026-25797

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

The ps encoders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicious file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed.

The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24481)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24484)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24485)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-25576)

ImageMagick is a widely used open-source software suite for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in the ASHLAR image writer. An attacker can exploit this vulnerability by providing a specially crafted image file, which causes small memory objects to be allocated but never freed. Continuous processing of such malicious images will gradually exhaust the process memory, ultimately leading to a Denial of Service (DoS) condition. This vulnerability is classified under CWE-401 (Improper Release of Memory Before Removing Last Reference).(CVE-2026-25637)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a memory leak vulnerability exists in coders/msl.c. The vulnerability stems from the WriteMSLImage function returning early without releasing allocated resources. A remote attacker could exploit this vulnerability by providing a specially crafted image file, leading to memory exhaustion and ultimately resulting in a Denial of Service (DoS) condition, rendering the system or application unavailable. This vulnerability is classified as CWE-401 (Memory Leak).(CVE-2026-25638)

ImageMagick is free and open-source software used for editing and manipulating digital images. The WriteUHDRImage function in coders/uhdr.c uses int arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows the 32-bit int, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out-of-bounds heap write, which could be exploited to cause a denial of service or, in some cases, arbitrary code execution.(CVE-2026-25794) …

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24481)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24484)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24485)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-25576)

ImageMagick is a widely used open-source software suite for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in the ASHLAR image writer. An attacker can exploit this vulnerability by providing a specially crafted image file, which causes small memory objects to be allocated but never freed. Continuous processing of such malicious images will gradually exhaust the process memory, ultimately leading to a Denial of Service (DoS) condition. This vulnerability is classified under CWE-401 (Improper Release of Memory Before Removing Last Reference).(CVE-2026-25637)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a memory leak vulnerability exists in coders/msl.c. The vulnerability stems from the WriteMSLImage function returning early without releasing allocated resources. A remote attacker could exploit this vulnerability by providing a specially crafted image file, leading to memory exhaustion and ultimately resulting in a Denial of Service (DoS) condition, rendering the system or application unavailable. This vulnerability is classified as CWE-401 (Memory Leak).(CVE-2026-25638)

ImageMagick is a widely used free and open-source software for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference vulnerability exists in the ReadSFWImage() function located in coders/sfw.c. When temporary file creation fails, the read_info structure is destroyed before its filename member is accessed, causing the program to dereference a NULL pointer and crash. An attacker could exploit this issue to cause a Denial of Service (DoS).(CVE-2026-25795)

ImageMagick is a free and open-source software for editing…

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24481)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24484)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24485)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-25576)

ImageMagick is a widely used open-source software suite for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in the ASHLAR image writer. An attacker can exploit this vulnerability by providing a specially crafted image file, which causes small memory objects to be allocated but never freed. Continuous processing of such malicious images will gradually exhaust the process memory, ultimately leading to a Denial of Service (DoS) condition. This vulnerability is classified under CWE-401 (Improper Release of Memory Before Removing Last Reference).(CVE-2026-25637)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a memory leak vulnerability exists in coders/msl.c. The vulnerability stems from the WriteMSLImage function returning early without releasing allocated resources. A remote attacker could exploit this vulnerability by providing a specially crafted image file, leading to memory exhaustion and ultimately resulting in a Denial of Service (DoS) condition, rendering the system or application unavailable. This vulnerability is classified as CWE-401 (Memory Leak).(CVE-2026-25638)

ImageMagick is free and open-source software used for editing and manipulating digital images. The WriteUHDRImage function in coders/uhdr.c uses int arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows the 32-bit int, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out-of-bounds heap write, which could be exploited to cause a denial of service or, in some cases, arbitrary code execution.(CVE-2026-25794) …

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24481)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24484)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24485)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-25576)

ImageMagick is a widely used open-source software suite for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in the ASHLAR image writer. An attacker can exploit this vulnerability by providing a specially crafted image file, which causes small memory objects to be allocated but never freed. Continuous processing of such malicious images will gradually exhaust the process memory, ultimately leading to a Denial of Service (DoS) condition. This vulnerability is classified under CWE-401 (Improper Release of Memory Before Removing Last Reference).(CVE-2026-25637)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a memory leak vulnerability exists in coders/msl.c. The vulnerability stems from the WriteMSLImage function returning early without releasing allocated resources. A remote attacker could exploit this vulnerability by providing a specially crafted image file, leading to memory exhaustion and ultimately resulting in a Denial of Service (DoS) condition, rendering the system or application unavailable. This vulnerability is classified as CWE-401 (Memory Leak).(CVE-2026-25638)

ImageMagick is free and open-source software used for editing and manipulating digital images. The WriteUHDRImage function in coders/uhdr.c uses int arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows the 32-bit int, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out-of-bounds heap write, which could be exploited to cause a denial of service or, in some cases, arbitrary code execution.(CVE-2026-25794) …

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24481)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24484)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24485)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-25576)

ImageMagick is a widely used open-source software suite for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in the ASHLAR image writer. An attacker can exploit this vulnerability by providing a specially crafted image file, which causes small memory objects to be allocated but never freed. Continuous processing of such malicious images will gradually exhaust the process memory, ultimately leading to a Denial of Service (DoS) condition. This vulnerability is classified under CWE-401 (Improper Release of Memory Before Removing Last Reference).(CVE-2026-25637)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a memory leak vulnerability exists in coders/msl.c. The vulnerability stems from the WriteMSLImage function returning early without releasing allocated resources. A remote attacker could exploit this vulnerability by providing a specially crafted image file, leading to memory exhaustion and ultimately resulting in a Denial of Service (DoS) condition, rendering the system or application unavailable. This vulnerability is classified as CWE-401 (Memory Leak).(CVE-2026-25638)

ImageMagick is free and open-source software used for editing and manipulating digital images. The WriteUHDRImage function in coders/uhdr.c uses int arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows the 32-bit int, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out-of-bounds heap write, which could be exploited to cause a denial of service or, in some cases, arbitrary code execution.(CVE-2026-25794) …

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24481)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24484)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-24485)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.(CVE-2026-25576)

ImageMagick is a widely used open-source software suite for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in the ASHLAR image writer. An attacker can exploit this vulnerability by providing a specially crafted image file, which causes small memory objects to be allocated but never freed. Continuous processing of such malicious images will gradually exhaust the process memory, ultimately leading to a Denial of Service (DoS) condition. This vulnerability is classified under CWE-401 (Improper Release of Memory Before Removing Last Reference).(CVE-2026-25637)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a memory leak vulnerability exists in coders/msl.c. The vulnerability stems from the WriteMSLImage function returning early without releasing allocated resources. A remote attacker could exploit this vulnerability by providing a specially crafted image file, leading to memory exhaustion and ultimately resulting in a Denial of Service (DoS) condition, rendering the system or application unavailable. This vulnerability is classified as CWE-401 (Memory Leak).(CVE-2026-25638)

ImageMagick is free and open-source software used for editing and manipulating digital images. The WriteUHDRImage function in coders/uhdr.c uses int arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows the 32-bit int, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out-of-bounds heap write, which could be exploited to cause a denial of service or, in some cases, arbitrary code execution.(CVE-2026-25794) …

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

• CVE-2026-25797: fix PostScript/HTML code injection via unsanitized filenames
• CVE-2026-25982: fix heap out-of-bounds read in DICOM colormap decoder
• CVE-2026-25968: fix stack buffer overflow in MSL opacity attribute processing
• CVE-2026-25986: fix heap buffer overflow write in YUV 4:2:2 decoder
• CVE-2026-25987: fix heap buffer over-read in MAP image decoder
• CVE-2026-25970: fix signed integer overflow in SIXEL decoder
• CVE-2026-23952: fix NULL pointer dereference in MSL comment/label handlers
• CVE-2026-30883: fix heap buffer overflow in PNG profile writer
• CVE-2026-25988: fix MSL stack index not updated causing memory leak
• CVE-2026-27798: fix heap buffer over-read in WaveletDenoiseImage
• CVE-2026-25965: fix path traversal bypassing security policy

• CVE-2026-25797: fix PostScript/HTML code injection via unsanitized filenames
• CVE-2026-25982: fix heap out-of-bounds read in DICOM colormap decoder
• CVE-2026-25968: fix stack buffer overflow in MSL opacity attribute processing
• CVE-2026-25986: fix heap buffer overflow write in YUV 4:2:2 decoder
• CVE-2026-25987: fix heap buffer over-read in MAP image decoder
• CVE-2026-25970: fix signed integer overflow in SIXEL decoder
• CVE-2026-23952: fix NULL pointer dereference in MSL comment/label handlers
• CVE-2026-30883: fix heap buffer overflow in PNG profile writer
• CVE-2026-25988: fix MSL stack index not updated causing memory leak
• CVE-2026-27798: fix heap buffer over-read in WaveletDenoiseImage
• CVE-2026-25965: fix path traversal bypassing security policy

• SECURITY UPDATE: stack buffer overflow in msl.c (attribute handling), path traversal bypass of security policy, XSS in HTML coder output, and MSL attribute overflow
  • debian/patches/CVE-2026-25797_CVE-2026-25965_CVE-2026-25968_CVE-2026-25982.patch: Fix memory leaks, stack overflows, integer overflows and out‑of‑bounds reads; add bounds checks, validate DCM entry sizes, sanitize PostScript filenames, canonicalize paths and free resources; escape user-controlled strings written as raw HTML in the HTML coder; cause was unsafe header and filename parsing, incorrect assumptions about byte counts, path resolution, unnormalized path matching allowing policy bypass, and unescaped HTML output enabling cross-site scripting.
  • CVE-2026-25797
  • CVE-2026-25965
  • CVE-2026-25968
  • CVE-2026-25982
• SECURITY UPDATE: null pointer dereference in msl.c (repage/roll handlers)
  • debian/patches/CVE-2026-25983.patch: move image null‑checks before accessing image attributes in the repage and roll MSL tag handlers; cause was dereferencing the image pointer for page geometry and dimensions before verifying the image was defined.
  • CVE-2026-25983
• SECURITY UPDATE: infinite recursion via crafted MSL/SVG/MVG files
  • debian/patches/CVE-2026-25971.patch: add global Splay tree guards in MSL and SVG coders to detect and reject recursive image references; block dangerous protocols (ftp, http, mvg, vid) in DrawPrimitive; cause was unbounded recursion through nested image reads.
  • CVE-2026-25971
• SECURITY UPDATE: null pointer dereference in msl.c (comment/label handlers)
  • debian/patches/CVE-2026-23952.patch: add image null-checks before accessing image properties in the comment and label MSL end-element handlers; cause was dereferencing the image pointer for DeleteImageProperty before verifying the image was defined.
  • CVE-2026-23952
• SECURITY UPDATE: MSLPushImage return value not captured
  • debian/patches/CVE-2026-25988.patch: change MSLPushImage to return the new image index and capture the return value in the MSL image tag handler; cause was the local index variable not being updated after pushing a new image onto the stack.
  • CVE-2026-25988

• SECURITY UPDATE: stack buffer overflow in msl.c (attribute handling), path traversal bypass of security policy, XSS in HTML coder output, and MSL attribute overflow
  • debian/patches/CVE-2026-25797_CVE-2026-25965_CVE-2026-25968_CVE-2026-25982.patch: Fix memory leaks, stack overflows, integer overflows and out‑of‑bounds reads; add bounds checks, validate DCM entry sizes, sanitize PostScript filenames, canonicalize paths and free resources; escape user-controlled strings written as raw HTML in the HTML coder; cause was unsafe header and filename parsing, incorrect assumptions about byte counts, path resolution, unnormalized path matching allowing policy bypass, and unescaped HTML output enabling cross-site scripting.
  • CVE-2026-25797
  • CVE-2026-25965
  • CVE-2026-25968
  • CVE-2026-25982
• SECURITY UPDATE: null pointer dereference in msl.c (repage/roll handlers)
  • debian/patches/CVE-2026-25983.patch: move image null‑checks before accessing image attributes in the repage and roll MSL tag handlers; cause was dereferencing the image pointer for page geometry and dimensions before verifying the image was defined.
  • CVE-2026-25983
• SECURITY UPDATE: infinite recursion via crafted MSL/SVG/MVG files
  • debian/patches/CVE-2026-25971.patch: add global Splay tree guards in MSL and SVG coders to detect and reject recursive image references; block dangerous protocols (ftp, http, mvg, vid) in DrawPrimitive; cause was unbounded recursion through nested image reads.
  • CVE-2026-25971
• SECURITY UPDATE: null pointer dereference in msl.c (comment/label handlers)
  • debian/patches/CVE-2026-23952.patch: add image null-checks before accessing image properties in the comment and label MSL end-element handlers; cause was dereferencing the image pointer for DeleteImageProperty before verifying the image was defined.
  • CVE-2026-23952
• SECURITY UPDATE: MSLPushImage return value not captured
  • debian/patches/CVE-2026-25988.patch: change MSLPushImage to return the new image index and capture the return value in the MSL image tag handler; cause was the local index variable not being updated after pushing a new image onto the stack.
  • CVE-2026-25988

The updated packages fix numerous security vulnerabilities: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797. (CVE-2026-25797) Heap Buffer Underwrite in Floyd-Steinberg depth dithering. (CVE-2026-48724) Infinite Loop in subimage-search with crafted image. (CVE-2026-48733) Stack Overflow in MVG decoder. (CVE-2026-48734) Policy Bypass in DCM decoder could result in image with invalid dimensions. (CVE-2026-49218) Policy Bypass can read disallowed files. (CVE-2026-49219) Heap Buffer Over-Write in MAT decoder on 32-bit systems. (CVE-2026-48994) Policy Bypass can trigger out-of-Memory condition. (CVE-2026-53460) Heap Buffer Over-Write in ICON decoder due to incorrect loop. (CVE-2026-53461) Use-After-Free when allocation in CheckPrimitiveExtent fails. (CVE-2026-53462) Null Pointer Dereference in distort operation when passing incorrect arguments. (CVE-2026-53463) Memory Leak in wand option parser when providing invalid arguments. (CVE-2026-53464) Heap Buffer Over-Write in SF3 encoder when writing multi-frame image. (CVE-2026-53465) Heap Buffer Over-Read in XCF decoder due to integer conversion overflow. (CVE-2026-53466) Information Disclosure in MNG decoder because allocated memory is left unchanged. (CVE-2026-53467) Use-After-Free in crafted 8BIM when identifying an image. (CVE-2026-55510) Heap Buffer Overflow in ImageMagick MVG decoder. (CVE-2026-55577) Stack Overflow in MVG decoder due to missing depth check. (CVE-2026-55594) Infinite Loop in connected-components when providing invalid arguments. (CVE-2026-55595) Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments. (CVE-2026-55597) Policy Bypass in concatenate operation due to missing checks. (CVE-2026-55628)

These are all security issues fixed in the ImageMagick-7.1.2.15-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ImageMagick fixes the following issues:

• CVE-2026-22770: improper pointer initialization can cause denial of service (bsc#1256969).
• CVE-2026-23874: manipulation of digital images can lead to stack overflow (bsc#1256976).
• CVE-2026-23876: ImageMagick: maliciously crafted image can lead to heap buffer overflow (bsc#1256962).
• CVE-2026-23952: processing comment tag can cause null pointer dereference (bsc#1257076).
• CVE-2026-24481: Possible Heap Information Disclosure in PSD ZIP Decompression (bsc#1258743).
• CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
• CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
• CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
• CVE-2026-25637: Denial of Service via crafted image due to memory leak (bsc#1258759).
• CVE-2026-25638: Denial of Service due to memory leak in image processing (bsc#1258793).
• CVE-2026-25794: Heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions (bsc#1258749).
• CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
• CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
• CVE-2026-25797: Code injection in various encoders (bsc#1258770).
• CVE-2026-25798: NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (bsc#1258787).
• CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
• CVE-2026-25897: Out-of-bounds heap write via integer overflow in sun decoder (bsc#1258799).
• CVE-2026-25898: Information disclosure or denial of service via crafted image with invalid pixel index (bsc#1258807).
• CVE-2026-25965: Policy bypass through path traversal allows reading restricted content despite secured policy (bsc#1258785).
• CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access (bsc#1258780).
• CVE-2026-25967: Stack buffer overflow in FTXT reader via oversized integer field (bsc#1258779).
• CVE-2026-25968: MSL attribute stack buffer overflow leads to out of bounds write (bsc#1258776).
• CVE-2026-25969: Memory Leak in coders/ashlar.c (bsc#1258775).
• CVE-2026-25970: Memory corruption and denial of service via signed integer overflow in SIXEL decoder (bsc#1258802).
• CVE-2026-25971: MSL: Stack overflow in ProcessMSLScript (bsc#1258774).
• CVE-2026-25982: Heap Out-of-Bounds Read in DCM Decoder (bsc#1258772).
• CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
• CVE-2026-25985: Memory allocation with excessive without limits in the internal SVG decoder (bsc#1258812).
• CVE-2026-25986: Denial of Service via malicious YUV image processing (bsc#1258818).
• CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
• CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
• CVE-2026-25989: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder (bsc#1258771).
• CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
• CVE-2026-26283: Possible infinite loop in JPEG encoder when using jpeg: extent (bsc#1258767).
• CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
• CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
• CVE-2026-27798: Heap Buffer Over-read in WaveletDenoise when processing small images (bsc#1259018).
• CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).

This update for ImageMagick fixes the following issues:

• CVE-2026-56365: memory leak in the PNG encoder when writing MNG images (bsc#1270004).
• CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided (bsc#1272575).
• CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument (bsc#1272582).
• CVE-2026-62946: integer overflow in JNX decoder leading to heap buffer overwrite when extremely large files are processed on 32-bit builds (bsc#1272580).
• CVE-2026-66011: memory leak in the magick command-line interface when invalid options are provided (bsc#1272577).
• CVE-2026-64685: heap buffer overread in BGR decoder due to missing end-of-file check (bsc#1272953).
• Code injection in HTML encoder due to incomplete fix of CVE-2026-25797 (bsc#1272579).

Root has patched CVE-2026-25797 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available.

This update for ImageMagick fixes the following issues:

• CVE-2026-24481: Possible Heap Information Disclosure in PSD ZIP Decompression (bsc#1258743).
• CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
• CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
• CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
• CVE-2026-25637: Denial of Service via crafted image due to memory leak (bsc#1258759).
• CVE-2026-25638: Denial of Service due to memory leak in image processing (bsc#1258793).
• CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
• CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
• CVE-2026-25797: Code injection in various encoders (bsc#1258770).
• CVE-2026-25798: NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (bsc#1258787).
• CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
• CVE-2026-25897: Out-of-bounds heap write via integer overflow in sun decoder (bsc#1258799).
• CVE-2026-25898: Information disclosure or denial of service via crafted image with invalid pixel index (bsc#1258807).
• CVE-2026-25965: Policy bypass through path traversal allows reading restricted content despite secured policy (bsc#1258785).
• CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access (bsc#1258780).
• CVE-2026-25967: Stack buffer overflow in FTXT reader via oversized integer field (bsc#1258779).
• CVE-2026-25968: MSL attribute stack buffer overflow leads to out of bounds write (bsc#1258776).
• CVE-2026-25969: Memory Leak in coders/ashlar.c (bsc#1258775).
• CVE-2026-25970: Memory corruption and denial of service via signed integer overflow in SIXEL decoder (bsc#1258802).
• CVE-2026-25971: MSL: Stack overflow in ProcessMSLScript (bsc#1258774).
• CVE-2026-25982: Heap Out-of-Bounds Read in DCM Decoder (bsc#1258772).
• CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
• CVE-2026-25985: Memory allocation with excessive without limits in the internal SVG decoder (bsc#1258812).
• CVE-2026-25986: Denial of Service via malicious YUV image processing (bsc#1258818).
• CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
• CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
• CVE-2026-25989: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder (bsc#1258771).
• CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
• CVE-2026-26283: Possible infinite loop in JPEG encoder when using jpeg: extent (bsc#1258767).
• CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
• CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
• CVE-2026-27798: Heap Buffer Over-read in WaveletDenoise when processing small images (bsc#1259018).
• CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).

This update for ImageMagick fixes the following issues:

• CVE-2026-24481: Possible Heap Information Disclosure in PSD ZIP Decompression (bsc#1258743).
• CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
• CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
• CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
• CVE-2026-25637: Denial of Service via crafted image due to memory leak (bsc#1258759).
• CVE-2026-25638: Denial of Service due to memory leak in image processing (bsc#1258793).
• CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
• CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
• CVE-2026-25797: Code injection in various encoders (bsc#1258770).
• CVE-2026-25798: NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (bsc#1258787).
• CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
• CVE-2026-25897: Out-of-bounds heap write via integer overflow in sun decoder (bsc#1258799).
• CVE-2026-25898: Information disclosure or denial of service via crafted image with invalid pixel index (bsc#1258807).
• CVE-2026-25965: Policy bypass through path traversal allows reading restricted content despite secured policy (bsc#1258785).
• CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access (bsc#1258780).
• CVE-2026-25967: Stack buffer overflow in FTXT reader via oversized integer field (bsc#1258779).
• CVE-2026-25968: MSL attribute stack buffer overflow leads to out of bounds write (bsc#1258776).
• CVE-2026-25969: Memory Leak in coders/ashlar.c (bsc#1258775).
• CVE-2026-25970: Memory corruption and denial of service via signed integer overflow in SIXEL decoder (bsc#1258802).
• CVE-2026-25971: MSL: Stack overflow in ProcessMSLScript (bsc#1258774).
• CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
• CVE-2026-25985: Memory allocation with excessive without limits in the internal SVG decoder (bsc#1258812).
• CVE-2026-25986: Denial of Service via malicious YUV image processing (bsc#1258818).
• CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
• CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
• CVE-2026-25989: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder (bsc#1258771).
• CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
• CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
• CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
• CVE-2026-27798: Heap Buffer Over-read in WaveletDenoise when processing small images (bsc#1259018).
• CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).

This update for ImageMagick fixes the following issues:

• CVE-2026-24481: Possible Heap Information Disclosure in PSD ZIP Decompression (bsc#1258743).
• CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
• CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
• CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
• CVE-2026-25637: Denial of Service via crafted image due to memory leak (bsc#1258759).
• CVE-2026-25638: Denial of Service due to memory leak in image processing (bsc#1258793).
• CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
• CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
• CVE-2026-25797: Code injection in various encoders (bsc#1258770).
• CVE-2026-25798: NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (bsc#1258787).
• CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
• CVE-2026-25897: Out-of-bounds heap write via integer overflow in sun decoder (bsc#1258799).
• CVE-2026-25898: Information disclosure or denial of service via crafted image with invalid pixel index (bsc#1258807).
• CVE-2026-25965: Policy bypass through path traversal allows reading restricted content despite secured policy (bsc#1258785).
• CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access (bsc#1258780).
• CVE-2026-25970: Memory corruption and denial of service via signed integer overflow in SIXEL decoder (bsc#1258802).
• CVE-2026-25971: MSL: Stack overflow in ProcessMSLScript (bsc#1258774).
• CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
• CVE-2026-25986: Denial of Service via malicious YUV image processing (bsc#1258818).
• CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
• CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
• CVE-2026-25989: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder (bsc#1258771).
• CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
• CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
• CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
• CVE-2026-27798: Heap Buffer Over-read in WaveletDenoise when processing small images (bsc#1259018).
• CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).

This update for ImageMagick fixes the following issues:

• CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
• CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).
• CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).
• CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792).
• CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757).
• CVE-2026-25797: Code injection in various encoders (bsc#1258770).
• CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).
• CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access (bsc#1258780).
• CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).
• CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).
• CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).
• CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).
• CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).
• CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).
• CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).

This update for ImageMagick fixes the following issues:

• CVE-2026-56365: memory leak in the PNG encoder when writing MNG images (bsc#1270004).
• CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided (bsc#1272575).
• CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument (bsc#1272582).
• CVE-2026-62946: integer overflow in JNX decoder leading to heap buffer overwrite when extremely large files are processed on 32-bit builds (bsc#1272580).
• CVE-2026-66011: memory leak in the magick command-line interface when invalid options are provided (bsc#1272577).
• CVE-2026-64685: heap buffer overread in BGR decoder due to missing end-of-file check (bsc#1272953).
• Code injection in HTML encoder due to incomplete fix of CVE-2026-25797 (bsc#1272579).

This update for ImageMagick fixes the following issues:

• CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided (bsc#1272575).
• CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bit builds (bsc#1272580).
• code injection in HTML encoder due to incomplete fix of CVE-2026-25797 (bsc#1272579).

This update for ImageMagick fixes the following issues:

• CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided (bsc#1272575).
• CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bit builds (bsc#1272580).
• GHSA-hc76-7mpc-qjqh: code injection in HTML encoder due to incomplete fix of CVE-2026-25797 (bsc#1272579).

This update for ImageMagick fixes the following issues:

• CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided (bsc#1272575).
• CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument (bsc#1272582).
• CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bit builds (bsc#1272580).
• CVE-2026-66011: memory leak in the magick command-line interface when invalid options are provided (bsc#1272577).
• GHSA-hc76-7mpc-qjqh: code injection in HTML encoder due to incomplete fix of CVE-2026-25797 (bsc#1272579).

This update for ImageMagick fixes the following issues:

• CVE-2026-62343: heap buffer over-write in morphology operation when an invalid kernel is provided (bsc#1272575).
• CVE-2026-62363: heap buffer over-write in fx operation (bsc#1272582).
• CVE-2026-62946: integer overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds (bsc#1272580).
• CVE-2026-64685: heap buffer over-read in BGR decoder due to missing end-of-file check (bsc#1272953).
• CVE-2026-66011: memory Leak when providing invalid options to the cli (bsc#1272577).
• CVE-2026-86420: denial of Service due to memory budget exhaustion (bsc#1279696).
• CVE-2026-86421: denial of Service via memory leak in MSL decoder (bsc#1279711).
• CVE-2026-86423: denial of service via heap-use-after-free in PerlMagick's GetList method (bsc#1279794).
• CVE-2026-86425: denial of Service due to heap-use-after-free vulnerability (bsc#1279797).
• CVE-2026-93586: use-after-free in the ImagesToBlob method can lead to a process crash (bsc#1281912).
• CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a denial of service (bsc#1281909).
• CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
• CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
• GHSA-hc76-7mpc-qjqh: code injection in HTML encoder due to incomplete fix of CVE-2026-25797 (bsc#1272579).

It was discovered that ImageMagick incorrectly handled certain malformed image files in certain instances. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could possibly use these issues to cause a denial of service or possibly execute code. These issues only affected Ubuntu 14.04 LTS. (CVE-2018-15607, CVE-2018-18544, CVE-2019-13137, CVE-2019-13391, CVE-2019-13391)

It was discovered that ImageMagick incorrectly handled certain malformed image files in certain instances. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could possibly use these issues to cause a denial of service or possibly execute code. (CVE-2026-24481, CVE-2026-24484, CVE-2026-24485, CVE-2026-25576, CVE-2026-25638, CVE-2026-25797, CVE-2026-25965)

It was discovered that ImageMagick incorrectly handled certain malformed image files in certain instances. If a user or automated system using ImageMagick were tricked into opening a specifically crafted image, an attacker could possibly use these issues to cause a denial of service or possibly execute code. These issues only affected Ubuntu 25.10. (CVE-2026-25637, CVE-2026-25794, CVE-2026-25795, CVE-2026-25796, CVE-2026-25797, CVE-2026-25798, CVE-2026-25799, CVE-2026-25897, CVE-2026-25898)