CVE-2026-56372

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.

An unrecognized magnify:method will result in an out of bounds read in the magnify operation.

==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a000000b30
READ of size 4 at 0x61a000000b30 thread T0

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.(CVE-2026-56366)

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.(CVE-2026-56372)

ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.(CVE-2026-56373)

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857)

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858)

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861)

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.(CVE-2026-56366)

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.(CVE-2026-56372)

ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.(CVE-2026-56373)

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857)

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858)

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861)

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.(CVE-2026-56366)

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.(CVE-2026-56372)

ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.(CVE-2026-56373)

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857)

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858)

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861)

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.(CVE-2026-56372)

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857)

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858)

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861)

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870)

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.

These are all security issues fixed in the ImageMagick-7.1.2.27-2.1 package on the GA media of openSUSE Tumbleweed.

This update for ImageMagick fixes the following issues

• CVE-2026-55628: Policy Bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: Heap-buffer-overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56377: Policy Bypass can create or truncate files (bsc#1270006).
• CVE-2026-61465: Policy Bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: Heap-use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: Policy Bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61861: Use-After-Free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61870: Memory leak in VIFF encoder when allocation fails (bsc#1271293).

Root has patched CVE-2026-56372 in the imagemagick package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-56372 in the imagemagick package for Root:Debian:13. Multiple fixed versions available.

This update for ImageMagick fixes the following issues

• CVE-2026-55628: Policy Bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: Heap-buffer-overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56377: Policy Bypass can create or truncate files (bsc#1270006).
• CVE-2026-61465: Policy Bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: Heap-use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: Policy Bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61861: Use-After-Free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61870: Memory leak in VIFF encoder when allocation fails (bsc#1271293).

This update for ImageMagick fixes the following issues

• CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
• CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
• CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
• CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
• CVE-2026-61861: use-after-free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
• CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
• CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
• CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
• CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
• CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
• CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
• CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
• CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
• CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).

This update for ImageMagick fixes the following issues

• CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
• CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
• CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
• CVE-2026-61860: use-after-free when freetype initialization fails (bsc#1271494).
• CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
• CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
• CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
• CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
• CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
• CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
• CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
• CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
• CVE-2026-61871: memory leak in ICON decoder when allocation fails (bsc#1271485).
• CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).
• CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
• CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61861: use-after-free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).

This update for ImageMagick fixes the following issues:

• CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
• CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache (bsc#1271100).
• CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
• CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized magnify:method value (bsc#1271314).
• CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640 bsc#1271315).
• CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
• CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
• CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
• CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
• CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
• CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
• CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
• CVE-2026-61860: use-after-free when freetype initialization fails (bsc#1271494).
• CVE-2026-61861: use-after-free in FormatMagickCaption when memory allocation fails (bsc#1271294).
• CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
• CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
• CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
• CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
• CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
• CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
• CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
• CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
• CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
• CVE-2026-61872: memory leak in TIFF encoder when invalid tiff:tile-geometry is specified (bsc#1271484).
• Extend CVE-2026-56379 patch by f63c78b (bsc#1268878).