CVE-2026-61857

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.(CVE-2026-56366)

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.(CVE-2026-56372)

ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.(CVE-2026-56373)

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857)

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858)

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861)

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.(CVE-2026-56366)

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.(CVE-2026-56372)

ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.(CVE-2026-56373)

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857)

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858)

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861)

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.(CVE-2026-56366)

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.(CVE-2026-56372)

ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.(CVE-2026-56373)

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857)

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858)

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861)

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.(CVE-2026-56372)

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857)

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858)

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861)

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.(CVE-2026-56366)

ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.(CVE-2026-56373)

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857)

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858)

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861)

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

• CVE-2026-61857: check ResizeQuantumMemory() return value in ParseEntities() (magick/xml-tree.c) to avoid a NULL-pointer dereference
• CVE-2026-61863: destroy the huffman_image clone on temp-file open failure in WriteGROUP4Image() (coders/tiff.c) to fix a memory leak
• CVE-2026-61870: relinquish pixel_info before throwing on colormap allocation failure in WriteVIFFImage() (coders/viff.c) to fix a memory leak

• CVE-2026-61857: check ResizeQuantumMemory() return value in ParseEntities() (magick/xml-tree.c) to avoid a NULL-pointer dereference
• CVE-2026-61863: destroy the huffman_image clone on temp-file open failure in WriteGROUP4Image() (coders/tiff.c) to fix a memory leak
• CVE-2026-61870: relinquish pixel_info before throwing on colormap allocation failure in WriteVIFFImage() (coders/viff.c) to fix a memory leak

• CVE-2026-61857: check ResizeQuantumMemory() return value in ParseEntities() (magick/xml-tree.c) to avoid a NULL-pointer dereference
• CVE-2026-61863: destroy the huffman_image clone on temp-file open failure in WriteGROUP4Image() (coders/tiff.c) to fix a memory leak
• CVE-2026-61870: relinquish pixel_info before throwing on colormap allocation failure in WriteVIFFImage() (coders/viff.c) to fix a memory leak

• Rebase to EPEL 8 ImageMagick-6.9.13.52-2.el8, picking up the vendor's upstream soname-revert patch
• Drop the TuxCare backports for CVE-2026-61857, CVE-2026-61861, CVE-2026-61863, CVE-2026-61866 and CVE-2026-61870: all five are fixed in the 6.9.13.52 tarball, verified against the extracted source rather than the changelog
• Keep the CVE-2026-45664 backport: upstream dd198f960 landed in ImageMagick 7 and never reached the 6.x line, so both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer here
• Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
• CVE-2026-86420: relinquish the MemoryResource reservation when the in-memory pixel-cache allocation fails in OpenPixelCache (magick/cache.c)
• CVE-2026-86421: destroy the level's draw_info when MSLEndElement pops a group (coders/msl.c) to prevent a memory leak

• Rebase to EPEL 8 ImageMagick-6.9.13.52-2.el8, picking up the vendor's upstream soname-revert patch
• Drop the TuxCare backports for CVE-2026-61857, CVE-2026-61861, CVE-2026-61863, CVE-2026-61866 and CVE-2026-61870: all five are fixed in the 6.9.13.52 tarball, verified against the extracted source rather than the changelog
• Keep the CVE-2026-45664 backport: upstream dd198f960 landed in ImageMagick 7 and never reached the 6.x line, so both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer here
• Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
• CVE-2026-86420: relinquish the MemoryResource reservation when the in-memory pixel-cache allocation fails in OpenPixelCache (magick/cache.c)
• CVE-2026-86421: destroy the level's draw_info when MSLEndElement pops a group (coders/msl.c) to prevent a memory leak

• Rebase to EPEL 8 ImageMagick-6.9.13.52-2.el8, picking up the vendor's upstream soname-revert patch
• Drop the TuxCare backports for CVE-2026-61857, CVE-2026-61861, CVE-2026-61863, CVE-2026-61866 and CVE-2026-61870: all five are fixed in the 6.9.13.52 tarball, verified against the extracted source rather than the changelog
• Keep the CVE-2026-45664 backport: upstream dd198f960 landed in ImageMagick 7 and never reached the 6.x line, so both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer here
• Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
• CVE-2026-86420: relinquish the MemoryResource reservation when the in-memory pixel-cache allocation fails in OpenPixelCache (magick/cache.c)
• CVE-2026-86421: destroy the level's draw_info when MSLEndElement pops a group (coders/msl.c) to prevent a memory leak

• Rebase to EPEL 8 ImageMagick-6.9.13.52-2.el8, picking up the vendor's upstream soname-revert patch
• Drop the TuxCare backports for CVE-2026-61857, CVE-2026-61861, CVE-2026-61863, CVE-2026-61866 and CVE-2026-61870: all five are fixed in the 6.9.13.52 tarball, verified against the extracted source rather than the changelog
• Keep the CVE-2026-45664 backport: upstream dd198f960 landed in ImageMagick 7 and never reached the 6.x line, so both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer here
• Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
• CVE-2026-86420: relinquish the MemoryResource reservation when the in-memory pixel-cache allocation fails in OpenPixelCache (magick/cache.c)
• CVE-2026-86421: destroy the level's draw_info when MSLEndElement pops a group (coders/msl.c) to prevent a memory leak

These are all security issues fixed in the ImageMagick-7.1.2.27-2.1 package on the GA media of openSUSE Tumbleweed.

This update for ImageMagick fixes the following issues

• CVE-2026-55628: Policy Bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: Heap-buffer-overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56377: Policy Bypass can create or truncate files (bsc#1270006).
• CVE-2026-61465: Policy Bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: Heap-use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: Policy Bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61861: Use-After-Free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61870: Memory leak in VIFF encoder when allocation fails (bsc#1271293).

Root has patched CVE-2026-61857 in the imagemagick package for Root:Debian:13. Multiple fixed versions available.

This update for ImageMagick fixes the following issues

• CVE-2026-55628: Policy Bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: Heap-buffer-overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56377: Policy Bypass can create or truncate files (bsc#1270006).
• CVE-2026-61465: Policy Bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: Heap-use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: Policy Bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61861: Use-After-Free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61870: Memory leak in VIFF encoder when allocation fails (bsc#1271293).

This update for ImageMagick fixes the following issues

• CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
• CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
• CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
• CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
• CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
• CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
• CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
• CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).

This update for ImageMagick fixes the following issues

• CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
• CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
• CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
• CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
• CVE-2026-61861: use-after-free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
• CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
• CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
• CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
• CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
• CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
• CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
• CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
• CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
• CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).

This update for ImageMagick fixes the following issues

• CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
• CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
• CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
• CVE-2026-61860: use-after-free when freetype initialization fails (bsc#1271494).
• CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
• CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
• CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
• CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
• CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
• CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
• CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
• CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
• CVE-2026-61871: memory leak in ICON decoder when allocation fails (bsc#1271485).
• CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).
• CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
• CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61861: use-after-free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).

This update for ImageMagick fixes the following issues:

• CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
• CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
• CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
• CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
• CVE-2026-61860: use-after-free when freetype initialization fails (bsc#1271494).
• CVE-2026-61861: use-after-free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
• CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
• CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
• CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
• CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
• CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
• CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
• CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
• CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
• CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).
• Extend CVE-2026-56379 patch by f63c78b (bsc#1268878).

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56366, CVE-2026-56368, CVE-2026-56371, CVE-2026-56373)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-56370)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or expose sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56378)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56379)

It was discovered that ImageMagick incorrectly handled memory allocation in certain operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61465)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-61857)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-61863, CVE-2026-61864, CVE-2026-61865, CVE-2026-61870)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61866)

It was discovered that ImageMagick incorrectly handled certain images on 32-bit systems. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-62946)

USN-8739-1 fixed vulnerabilities in ImageMagick. This update provides the corresponding fixes for Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56366, CVE-2026-56368, CVE-2026-56371, CVE-2026-56373)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-56370)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or expose sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56378)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56379)

It was discovered that ImageMagick incorrectly handled memory allocation in certain operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61465)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-61857)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-61863, CVE-2026-61864, CVE-2026-61865, CVE-2026-61870)

It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61866)

It was discovered that ImageMagick incorrectly handled certain images on 32-bit systems. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-62946)