CVE-2026-34238

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, an integer overflow in the despeckle operation causes a heap buffer overflow on 32-bit builds that will result in an out of bounds write. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

An integer overflow in the despeckle operation causes a heap buffer overflow on 32-bit builds that will result in an out of bounds write.

==1551685==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xea2fb818 at pc 0x56cbc42a bp 0xffc4ce48 sp 0xffc4ce38
WRITE of size 8 at 0xea2fb818 thread T0

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, an integer overflow in the despeckle operation causes a heap buffer overflow on 32-bit builds that will result in an out of bounds write. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, an integer overflow in the despeckle operation causes a heap buffer overflow on 32-bit builds that will result in an out of bounds write. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

• CVE-2026-33900: fix integer truncation in viff encoder leading to heap out-of-bounds write on 32-bit builds
• CVE-2026-33905: fix out-of-bounds read in -sample operation via sample:offset define
• CVE-2026-34238: fix integer overflow in despeckle operation causing heap buffer overflow on 32-bit builds
• CVE-2026-40310: fix heap out-of-bounds write in JP2 encoder on invalid sampling index
• CVE-2026-40311: fix heap use-after-free reading and printing values from an invalid XMP profile

• CVE-2026-33900: fix integer truncation in viff encoder leading to heap out-of-bounds write on 32-bit builds
• CVE-2026-33905: fix out-of-bounds read in -sample operation via sample:offset define
• CVE-2026-34238: fix integer overflow in despeckle operation causing heap buffer overflow on 32-bit builds
• CVE-2026-40310: fix heap out-of-bounds write in JP2 encoder on invalid sampling index
• CVE-2026-40311: fix heap use-after-free reading and printing values from an invalid XMP profile

• CVE-2026-33900: fix integer truncation in viff encoder leading to heap out-of-bounds write on 32-bit builds
• CVE-2026-33905: fix out-of-bounds read in -sample operation via sample:offset define
• CVE-2026-34238: fix integer overflow in despeckle operation causing heap buffer overflow on 32-bit builds
• CVE-2026-40310: fix heap out-of-bounds write in JP2 encoder on invalid sampling index
• CVE-2026-40311: fix heap use-after-free reading and printing values from an invalid XMP profile

• SECURITY UPDATE: fix heap-based buffer overflow in VIFF coder
  • debian/patches/CVE-2026-33900.patch: fix heap-based buffer overflow in VIFF coder
  • CVE-2026-33900
• SECURITY UPDATE: fix heap-based buffer overflow in SampleImage
  • debian/patches/CVE-2026-33905.patch: fix heap-based buffer overflow in SampleImage
  • CVE-2026-33905
• SECURITY UPDATE: fix integer overflow in DespeckleImage
  • debian/patches/CVE-2026-34238.patch: fix integer overflow in DespeckleImage
  • CVE-2026-34238
• SECURITY UPDATE: fix heap out-of-bounds write in JP2 coder
  • debian/patches/CVE-2026-40310.patch: fix heap out-of-bounds write in JP2 coder
  • CVE-2026-40310
• SECURITY UPDATE: fix vulnerability in GetXMPProperty
  • debian/patches/CVE-2026-40311.patch: fix vulnerability in GetXMPProperty
  • CVE-2026-40311

• CVE-2026-86425: split a copy of the image list at the first NULL: image in the PerlMagick Layers method to prevent a heap use-after-free
• CVE-2026-86423: clone every image that appears more than once in a PerlMagick image list, not only adjacent repeats, so the same image is never linked into a list twice
• CVE-2026-86424: open the delegate output file without following symbolic links and check the write policy again after opening it, to prevent a symlink race from bypassing the path policy
• CVE-2026-34238: check the despeckle buffer size for integer overflow to prevent a heap buffer overflow on 32-bit systems

• CVE-2026-86425: split a copy of the image list at the first NULL: image in the PerlMagick Layers method to prevent a heap use-after-free
• CVE-2026-86423: clone every image that appears more than once in a PerlMagick image list, not only adjacent repeats, so the same image is never linked into a list twice
• CVE-2026-86424: open the delegate output file without following symbolic links and check the write policy again after opening it, to prevent a symlink race from bypassing the path policy
• CVE-2026-34238: check the despeckle buffer size for integer overflow to prevent a heap buffer overflow on 32-bit systems

These are all security issues fixed in the ImageMagick-7.1.2.19-2.1 package on the GA media of openSUSE Tumbleweed.

This update for ImageMagick fixes the following issues:

• CVE-2026-32259: stack out-of-bounds write due to a memory allocation failure in the sixel encoder can lead to a crash (bsc#1259612).
• CVE-2026-32636: out-of-bounds write of a single zero byte due to bug the NewXMLTree method can lead to denial of service (bsc#1259872).
• CVE-2026-33535: out-of-bounds write of a zero byte in X11 display interaction path can lead to a crash (bsc#1260874).
• CVE-2026-33536: stack out-of-bounds write due to incorrect return value on certain platforms can lead to a denial of service (bsc#1260879).
• CVE-2026-33899: out-of-bounds write of single zero byte in XML parsing can lead to a denial of service (bsc#1262154).
• CVE-2026-33900: heap out-of-bounds write due to integer truncation in viff encoder can lead to a crash (bsc#1262156).
• CVE-2026-33901: heap buffer overflow in the MVG decoder can lead to memory corruption or a crash (bsc#1262155).
• CVE-2026-33902: stack buffer overflow in the FX expression parser can lead to a process crash (bsc#1262153).
• CVE-2026-33905: out-of-bounds read in -sample operation can lead to a denial of service (bsc#1262097).
• CVE-2026-33908: recursive execution with no depth limit imposed when processing XML files can lead to resource exhaustion and a denial of service (bsc#1262152).
• CVE-2026-34238: heap buffer overflow due to integer overflow in the despeckle operation can lead to a denial of service (bsc#1262147).
• CVE-2026-40169: out-of-bounds heap write when processing a crafted image and writing a YAML or JSON output can lead to a crash (bsc#1262150).
• CVE-2026-40183: heap out-of-bounds write in the JXL encoder can lead to a denial of service (bsc#1262145).
• CVE-2026-40310: heap out-of-bounds write in the JP2 encoder can lead to a denial of service (bsc#1262148).
• CVE-2026-40311: heap use-after-free when reading and printing values from an invalid XMP profile can lead to a denial of service (bsc#1262146).
• CVE-2026-40312: off-by-one error in the MSL decoder can lead to a crash (bsc#1262149).

Root has patched CVE-2026-34238 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available.

This update for ImageMagick fixes the following issues:

• CVE-2026-33899: Denial of Service via out-of-bounds write in XML parsing (bsc#1262154).
• CVE-2026-33900: Denial of Service via integer truncation in viff encoder (bsc#1262156).
• CVE-2026-33905: Denial of service via out-of-bounds read in -sample operation (bsc#1262097).
• CVE-2026-33908: Denial of Service via deeply nested XML file processing (bsc#1262152).
• CVE-2026-34238: Denial of Service via integer overflow in despeckle operation (bsc#1262147).
• CVE-2026-40311: Denial of Service via heap use-after-free in XMP profile processing (bsc#1262146).

This update for ImageMagick fixes the following issues:

• CVE-2026-33899: Denial of Service via out-of-bounds write in XML parsing (bsc#1262154).
• CVE-2026-33900: Denial of Service via integer truncation in viff encoder (bsc#1262156).
• CVE-2026-33901: Denial of Service due to heap buffer overflow in MVG decoder (bsc#1262155).
• CVE-2026-33905: Denial of service via out-of-bounds read in -sample operation (bsc#1262097).
• CVE-2026-33908: Denial of Service via deeply nested XML file processing (bsc#1262152).
• CVE-2026-34238: Denial of Service via integer overflow in despeckle operation (bsc#1262147).
• CVE-2026-40169: Denial of Service via crafted image leading to out-of-bounds write (bsc#1262150).
• CVE-2026-40183: Denial of Service via heap write overflow in JXL encoder (bsc#1262145).
• CVE-2026-40310: Denial of service via heap out-of-bounds write in JP2 encoder (bsc#1262148).
• CVE-2026-40311: Denial of Service via heap use-after-free in XMP profile processing (bsc#1262146).
• CVE-2026-40312: Denial of Service via malicious MSL file processing (bsc#1262149).

This update for ImageMagick fixes the following issues:

• CVE-2026-33899: Denial of Service via out-of-bounds write in XML parsing (bsc#1262154).
• CVE-2026-33900: Denial of Service via integer truncation in viff encoder (bsc#1262156).
• CVE-2026-33901: Denial of Service due to heap buffer overflow in MVG decoder (bsc#1262155).
• CVE-2026-33902: Denial of Service via deeply nested expression in FX parser (bsc#1262153).
• CVE-2026-33905: Denial of service via out-of-bounds read in -sample operation (bsc#1262097).
• CVE-2026-33908: Denial of Service via deeply nested XML file processing (bsc#1262152).
• CVE-2026-34238: Denial of Service via integer overflow in despeckle operation (bsc#1262147).
• CVE-2026-40169: Denial of Service via crafted image leading to out-of-bounds write (bsc#1262150).
• CVE-2026-40183: Denial of Service via heap write overflow in JXL encoder (bsc#1262145).
• CVE-2026-40310: Denial of service via heap out-of-bounds write in JP2 encoder (bsc#1262148).
• CVE-2026-40311: Denial of Service via heap use-after-free in XMP profile processing (bsc#1262146).
• CVE-2026-40312: Denial of Service via malicious MSL file processing (bsc#1262149).

This update for ImageMagick fixes the following issues:

• CVE-2026-32259: stack out-of-bounds write due to a memory allocation failure in the sixel encoder can lead to a crash (bsc#1259612).
• CVE-2026-32636: out-of-bounds write of a single zero byte due to bug the NewXMLTree method can lead to denial of service (bsc#1259872).
• CVE-2026-33535: out-of-bounds write of a zero byte in X11 display interaction path can lead to a crash (bsc#1260874).
• CVE-2026-33536: stack out-of-bounds write due to incorrect return value on certain platforms can lead to a denial of service (bsc#1260879).
• CVE-2026-33899: out-of-bounds write of single zero byte in XML parsing can lead to a denial of service (bsc#1262154).
• CVE-2026-33900: heap out-of-bounds write due to integer truncation in viff encoder can lead to a crash (bsc#1262156).
• CVE-2026-33901: heap buffer overflow in the MVG decoder can lead to memory corruption or a crash (bsc#1262155).
• CVE-2026-33902: stack buffer overflow in the FX expression parser can lead to a process crash (bsc#1262153).
• CVE-2026-33905: out-of-bounds read in -sample operation can lead to a denial of service (bsc#1262097).
• CVE-2026-33908: recursive execution with no depth limit imposed when processing XML files can lead to resource exhaustion and a denial of service (bsc#1262152).
• CVE-2026-34238: heap buffer overflow due to integer overflow in the despeckle operation can lead to a denial of service (bsc#1262147).
• CVE-2026-40169: out-of-bounds heap write when processing a crafted image and writing a YAML or JSON output can lead to a crash (bsc#1262150).
• CVE-2026-40183: heap out-of-bounds write in the JXL encoder can lead to a denial of service (bsc#1262145).
• CVE-2026-40310: heap out-of-bounds write in the JP2 encoder can lead to a denial of service (bsc#1262148).
• CVE-2026-40311: heap use-after-free when reading and printing values from an invalid XMP profile can lead to a denial of service (bsc#1262146).
• CVE-2026-40312: off-by-one error in the MSL decoder can lead to a crash (bsc#1262149).

This update for ImageMagick fixes the following issues

This update for ImageMagick fixes the following issues

• CVE-2026-33899: Denial of Service via out-of-bounds write in XML parsing (bsc#1262154).
• CVE-2026-33900: Denial of Service via integer truncation in viff encoder (bsc#1262156).
• CVE-2026-33901: Denial of Service due to heap buffer overflow in MVG decoder (bsc#1262155).
• CVE-2026-33908: Denial of Service via deeply nested XML file processing (bsc#1262152).
• CVE-2026-34238: Denial of Service via integer overflow in despeckle operation (bsc#1262147).
• CVE-2026-40169: Denial of Service via crafted image leading to out-of-bounds write (bsc#1262150).
• CVE-2026-40310: Denial of service via heap out-of-bounds write in JP2 encoder (bsc#1262148).
• CVE-2026-40311: Denial of Service via heap use-after-free in XMP profile processing (bsc#1262146).
• CVE-2026-42050: Stack buffer overflow in XTileImage (bsc#1265048).
• CVE-2026-42326: Information disclosure via malicious IPTC input file (bsc#1268092).
• CVE-2026-45031: Denial of Service due to resource policy bypass in PSD decoder (bsc#1268094).
• CVE-2026-45359: Information Disclosure via Invalid Connected-Components Value (bsc#1268095).
• CVE-2026-45624: Data exposure due to image processing vulnerability (bsc#1268096).
• CVE-2026-45664: Denial of Service due to excessive resource use in MNG coder (bsc#1268101).
• CVE-2026-46520: Denial of Service via out-of-bounds write when processing multiple images (bsc#1268112).
• CVE-2026-46521: out of bounds write can occur due to a missing check when using LZMA compression in the MIFF encoder (bsc#1268124).
• CVE-2026-46522: denial of service via crafted MIFF file due to a missing check in the MIFF decoder (bsc#1268126).
• CVE-2026-46523: heap-use-after-free via a crafted MSL image (bsc#1268125).
• CVE-2026-46559: heap buffer over-write of a single byte when specifying certain options due to n incorrect check in the JP2 (bsc#1268121).
• CVE-2026-46692: heap buffer over-write in the server process via an attacker who can connect to a magick -distribute- cache service (bsc#1268120).
• CVE-2026-46693: file descriptor hijacking in the server process when a race condition is met via an attacker who can connect to a magick -distribute-cache service (bsc#1268117).
• CVE-2026-47165: distributed pixel cache was originally designed to operate without a challenge--response authentication model (bsc#1268114).
• CVE-2026-47166: heap buffer over-read in the server process via an attacker who can connect to a magick -distribute- cache service (bsc#1268113).
• CVE-2026-48734: Stack Overflow in MVG decoder (bsc#1268122).
• CVE-2026-48994: heap buffer over-write due to a missing check of a return value in the MAT decoder on 32-bit systems (bsc#1268111).
• CVE-2026-49218: denial of service due to a missing check in the DCM decoder (bsc#1268110).
• CVE-2026-53460: out-of-Memory condition due to a missing check for maximum memory request in AcquireAlignedMemory (bsc#1268108).
• CVE-2026-53463: null pointer deference due to passing incorrect arguments in the distort operation (bsc#1268105).
• CVE-2026-53464: small memory leak due to providing invalid options to the wand option parser (bsc#1268103).

It was discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-33535)

Kamil Frankowicz discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-33536)

It was discovered that ImageMagick did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-34238)

Jake Lamberson discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-40310)

Junmin Zhu discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-40311)

It was discovered that ImageMagick did not correctly handle opening certain MSL files. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly cause a denial of service. This issue affected Ubuntu 26.04 LTS. (CVE-2026-40312)

It was discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-56361)