CVE-2026-86424

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.(CVE-2026-86420)

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.(CVE-2026-86421)

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).(CVE-2026-86423)

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.(CVE-2026-86424)

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).(CVE-2026-86425)

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.

• CVE-2026-86425: split a copy of the image list at the first NULL: image in the PerlMagick Layers method to prevent a heap use-after-free
• CVE-2026-86423: clone every image that appears more than once in a PerlMagick image list, not only adjacent repeats, so the same image is never linked into a list twice
• CVE-2026-86424: open the delegate output file without following symbolic links and check the write policy again after opening it, to prevent a symlink race from bypassing the path policy
• CVE-2026-34238: check the despeckle buffer size for integer overflow to prevent a heap buffer overflow on 32-bit systems

• CVE-2026-86425: split a copy of the image list at the first NULL: image in the PerlMagick Layers method to prevent a heap use-after-free
• CVE-2026-86423: clone every image that appears more than once in a PerlMagick image list, not only adjacent repeats, so the same image is never linked into a list twice
• CVE-2026-86424: open the delegate output file without following symbolic links and check the write policy again after opening it, to prevent a symlink race from bypassing the path policy
• CVE-2026-34238: check the despeckle buffer size for integer overflow to prevent a heap buffer overflow on 32-bit systems

Heap-use-after-free in Layer method of PerlMagick could result in a crash Path Policy TOCTOU symlink race bypass in the video decoder Heap-use-after-free in the GetList method of PerlMagick could result in a crash Memory Leak in MSL decoder Denial of service when exhausting the process memory budget Policy Bypass in UHDR encoder Division by Zero in FLIF encoder Null Pointer Dereference in PNM coder when hitting a memory limit Policy Bypass in PCD, CUBE and HALD decoder when using a specific command line option. Use after free in ImagesToBlob method

These are all security issues fixed in the ImageMagick-7.1.2.31-1.1 package on the GA media of openSUSE Tumbleweed.