CVE-2026-33535

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, an out-of-bounds write of a zero byte exists in the X11 display interaction path that could lead to a crash. Versions 7.1.2-18 and 6.9.13-43 patch the issue.

An out-of-bounds write of a zero byte exists in the X11 display interaction path that could lead to a crash.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, an out-of-bounds write of a zero byte exists in the X11 display interaction path that could lead to a crash. Versions 7.1.2-18 and 6.9.13-43 patch the issue.

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, BilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the -bilateral-blur operation an out of bounds read can occur. This vulnerability is fixed in 7.1.2-16.(CVE-2026-30935)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.(CVE-2026-32636)

ImageMagick contains an out-of-bounds write vulnerability in X11 display interaction that could allow an attacker to cause memory corruption or execute arbitrary code.(CVE-2026-33535)

ImageMagick has a stack buffer overflow vulnerability in the InterpretImageFilename function that causes WRITE operation out-of-bounds due to buffer overflow. Attackers can exploit this vulnerability to execute arbitrary code or cause service crashes.(CVE-2026-33536)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, BilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the -bilateral-blur operation an out of bounds read can occur. This vulnerability is fixed in 7.1.2-16.(CVE-2026-30935)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.(CVE-2026-32636)

ImageMagick contains an out-of-bounds write vulnerability in X11 display interaction that could allow an attacker to cause memory corruption or execute arbitrary code.(CVE-2026-33535)

ImageMagick has a stack buffer overflow vulnerability in the InterpretImageFilename function that causes WRITE operation out-of-bounds due to buffer overflow. Attackers can exploit this vulnerability to execute arbitrary code or cause service crashes.(CVE-2026-33536)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, BilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the -bilateral-blur operation an out of bounds read can occur. This vulnerability is fixed in 7.1.2-16.(CVE-2026-30935)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.(CVE-2026-32636)

ImageMagick contains an out-of-bounds write vulnerability in X11 display interaction that could allow an attacker to cause memory corruption or execute arbitrary code.(CVE-2026-33535)

ImageMagick has a stack buffer overflow vulnerability in the InterpretImageFilename function that causes WRITE operation out-of-bounds due to buffer overflow. Attackers can exploit this vulnerability to execute arbitrary code or cause service crashes.(CVE-2026-33536)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.(CVE-2026-32636)

ImageMagick contains an out-of-bounds write vulnerability in X11 display interaction that could allow an attacker to cause memory corruption or execute arbitrary code.(CVE-2026-33535)

ImageMagick has a stack buffer overflow vulnerability in the InterpretImageFilename function that causes WRITE operation out-of-bounds due to buffer overflow. Attackers can exploit this vulnerability to execute arbitrary code or cause service crashes.(CVE-2026-33536)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, BilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the -bilateral-blur operation an out of bounds read can occur. This vulnerability is fixed in 7.1.2-16.(CVE-2026-30935)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.(CVE-2026-32636)

ImageMagick contains an out-of-bounds write vulnerability in X11 display interaction that could allow an attacker to cause memory corruption or execute arbitrary code.(CVE-2026-33535)

ImageMagick has a stack buffer overflow vulnerability in the InterpretImageFilename function that causes WRITE operation out-of-bounds due to buffer overflow. Attackers can exploit this vulnerability to execute arbitrary code or cause service crashes.(CVE-2026-33536)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, BilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the -bilateral-blur operation an out of bounds read can occur. This vulnerability is fixed in 7.1.2-16.(CVE-2026-30935)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.(CVE-2026-32636)

ImageMagick contains an out-of-bounds write vulnerability in X11 display interaction that could allow an attacker to cause memory corruption or execute arbitrary code.(CVE-2026-33535)

ImageMagick has a stack buffer overflow vulnerability in the InterpretImageFilename function that causes WRITE operation out-of-bounds due to buffer overflow. Attackers can exploit this vulnerability to execute arbitrary code or cause service crashes.(CVE-2026-33536)

Root has patched CVE-2026-33535 in the rootio-imagemagick package for Root:Debian:11. Multiple fixed versions available.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, an out-of-bounds write of a zero byte exists in the X11 display interaction path that could lead to a crash. Versions 7.1.2-18 and 6.9.13-43 patch the issue.

ImageMagick has a heap overflow in the pcd decoder that leads to an out of bounds read. (CVE-2026-26284) ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction. (CVE-2026-33535)

These are all security issues fixed in the ImageMagick-7.1.2.18-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the GraphicsMagick-1.3.46-6.1 package on the GA media of openSUSE Tumbleweed.

This update for GraphicsMagick fixes the following issue:

• CVE-2026-33535: out-of-bounds write of a zero byte in the X11 display interaction path can lead to a crash (bsc#1260874).

This update for ImageMagick fixes the following issues:

• CVE-2026-32259: stack out-of-bounds write due to a memory allocation failure in the sixel encoder can lead to a crash (bsc#1259612).
• CVE-2026-32636: out-of-bounds write of a single zero byte due to bug the NewXMLTree method can lead to denial of service (bsc#1259872).
• CVE-2026-33535: out-of-bounds write of a zero byte in X11 display interaction path can lead to a crash (bsc#1260874).
• CVE-2026-33536: stack out-of-bounds write due to incorrect return value on certain platforms can lead to a denial of service (bsc#1260879).
• CVE-2026-33899: out-of-bounds write of single zero byte in XML parsing can lead to a denial of service (bsc#1262154).
• CVE-2026-33900: heap out-of-bounds write due to integer truncation in viff encoder can lead to a crash (bsc#1262156).
• CVE-2026-33901: heap buffer overflow in the MVG decoder can lead to memory corruption or a crash (bsc#1262155).
• CVE-2026-33902: stack buffer overflow in the FX expression parser can lead to a process crash (bsc#1262153).
• CVE-2026-33905: out-of-bounds read in -sample operation can lead to a denial of service (bsc#1262097).
• CVE-2026-33908: recursive execution with no depth limit imposed when processing XML files can lead to resource exhaustion and a denial of service (bsc#1262152).
• CVE-2026-34238: heap buffer overflow due to integer overflow in the despeckle operation can lead to a denial of service (bsc#1262147).
• CVE-2026-40169: out-of-bounds heap write when processing a crafted image and writing a YAML or JSON output can lead to a crash (bsc#1262150).
• CVE-2026-40183: heap out-of-bounds write in the JXL encoder can lead to a denial of service (bsc#1262145).
• CVE-2026-40310: heap out-of-bounds write in the JP2 encoder can lead to a denial of service (bsc#1262148).
• CVE-2026-40311: heap use-after-free when reading and printing values from an invalid XMP profile can lead to a denial of service (bsc#1262146).
• CVE-2026-40312: off-by-one error in the MSL decoder can lead to a crash (bsc#1262149).

Root has patched CVE-2026-33535 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-33535 in the rootio-imagemagick package for Root:Debian:13. Multiple fixed versions available.

This update for ImageMagick fixes the following issues:

• CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
• CVE-2026-28494: missing bounds checks in the morphology kernel parsing functions can lead to a stack buffer overflow (bsc#1259447).
• CVE-2026-28686: undersized output buffer allocation in the PCL encoder can lead to a heap buffer overflow (bsc#1259448).
• CVE-2026-28687: heap use-after-free vulnerability in the MSL decoder via a crafted MSL file (bsc#1259450).
• CVE-2026-28688: heap use-after-free in the MSL encoder when a cloned image is destroyed twice (bsc#1259451).
• CVE-2026-28689: domain='path' authorization is checked before final file open/use and allows for read/write bypass via symlink swaps (bsc#1259452).
• CVE-2026-28690: missing bounds check in the MNG encoder can lead to a stack buffer overflow (bsc#1259456).
• CVE-2026-28691: missing check in the JBIG decoder can lead to an uninitialized pointer dereference (bsc#1259455).
• CVE-2026-28692: 32-bit integer overflow in MAT decoder can lead to a heap buffer over-read (bsc#1259457).
• CVE-2026-28693: integer overflow in the DIB coder can lead to an out-of-bounds read or write (bsc#1259466).
• CVE-2026-30883: missing bounds check when encoding a PNG image can lead to a heap buffer over-write (bsc#1259467).
• CVE-2026-30937: Heap buffer overflow in XWD encoder due to CARD32 arithmetic overflow (bsc#1259463).
• CVE-2026-31853: heap buffer overflow leads to crash in the SFW decoder of 32-bit systems when processing extremely large images (bsc#1259528).
• CVE-2026-33535: Out-of-Bounds write of a zero byte in X11 display interaction (bsc#1260874).
• CVE-2026-33536: Denial of Service via out-of-bounds write (bsc#1260879).

This update for ImageMagick fixes the following issues:

• CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).
• CVE-2026-28493: integer overflow in the SIXEL decoder leads to out-of-bounds write (bsc#1259446).
• CVE-2026-28494: missing bounds checks in the morphology kernel parsing functions can lead to a stack buffer overflow (bsc#1259447).
• CVE-2026-28686: undersized output buffer allocation in the PCL encoder can lead to a heap buffer overflow (bsc#1259448).
• CVE-2026-28687: heap use-after-free vulnerability in the MSL decoder via a crafted MSL file (bsc#1259450).
• CVE-2026-28688: heap use-after-free in the MSL encoder when a cloned image is destroyed twice (bsc#1259451).
• CVE-2026-28689: domain='path' authorization is checked before final file open/use and allows for read/write bypass via symlink swaps (bsc#1259452).
• CVE-2026-28690: missing bounds check in the MNG encoder can lead to a stack buffer overflow (bsc#1259456).
• CVE-2026-28691: missing check in the JBIG decoder can lead to an uninitialized pointer dereference (bsc#1259455).
• CVE-2026-28692: 32-bit integer overflow in MAT decoder can lead to a heap buffer over-read (bsc#1259457).
• CVE-2026-28693: integer overflow in the DIB coder can lead to an out-of-bounds read or write (bsc#1259466).
• CVE-2026-30883: missing bounds check when encoding a PNG image can lead to a heap buffer over-write (bsc#1259467).
• CVE-2026-30929: improper use of fixed-size stack buffer in MagnifyImagecan lead to a stack buffer overflow (bsc#1259468).
• CVE-2026-30931: value truncation in the UHDR encoder can lead to a heap buffer overflow (bsc#1259469).
• CVE-2026-30935: heap-based buffer over-read in BilateralBlurImage (bsc#1259497).
• CVE-2026-30936: Heap Buffer Overflow in WaveletDenoiseImage (bsc#1259464).
• CVE-2026-30937: Heap buffer overflow in XWD encoder due to CARD32 arithmetic overflow (bsc#1259463).
• CVE-2026-31853: heap buffer overflow leads to crash in the SFW decoder of 32-bit systems when processing extremely large images (bsc#1259528).
• CVE-2026-32259: memory allocation fails can lead to out of bound write (bsc#1259612).
• CVE-2026-32636: Denial of Service via out-of-bounds write in NewXMLTree method (bsc#1259872).
• CVE-2026-33535: Out-of-Bounds write of a zero byte in X11 display interaction (bsc#1260874).
• CVE-2026-33536: Denial of Service via out-of-bounds write (bsc#1260879).

This update for ImageMagick fixes the following issues:

• CVE-2026-28493: integer overflow in the SIXEL decoder leads to out-of-bounds write (bsc#1259446).
• CVE-2026-28494: missing bounds checks in the morphology kernel parsing functions can lead to a stack buffer overflow (bsc#1259447).
• CVE-2026-28686: undersized output buffer allocation in the PCL encoder can lead to a heap buffer overflow (bsc#1259448).
• CVE-2026-28687: heap use-after-free vulnerability in the MSL decoder via a crafted MSL file (bsc#1259450).
• CVE-2026-28688: heap use-after-free in the MSL encoder when a cloned image is destroyed twice (bsc#1259451).
• CVE-2026-28689: domain='path' authorization is checked before final file open/use and allows for read/write bypass via symlink swaps (bsc#1259452).
• CVE-2026-28690: missing bounds check in the MNG encoder can lead to a stack buffer overflow (bsc#1259456).
• CVE-2026-28691: missing check in the JBIG decoder can lead to an uninitialized pointer dereference (bsc#1259455).
• CVE-2026-28692: 32-bit integer overflow in MAT decoder can lead to a heap buffer over-read (bsc#1259457).
• CVE-2026-28693: integer overflow in the DIB coder can lead to an out-of-bounds read or write (bsc#1259466).
• CVE-2026-30883: missing bounds check when encoding a PNG image can lead to a heap buffer over-write (bsc#1259467).
• CVE-2026-30929: improper use of fixed-size stack buffer in MagnifyImagecan lead to a stack buffer overflow (bsc#1259468).
• CVE-2026-30935: heap-based buffer over-read in BilateralBlurImage (bsc#1259497).
• CVE-2026-30936: Heap Buffer Overflow in WaveletDenoiseImage (bsc#1259464).
• CVE-2026-30937: Heap buffer overflow in XWD encoder due to CARD32 arithmetic overflow (bsc#1259463).
• CVE-2026-31853: heap buffer overflow leads to crash in the SFW decoder of 32-bit systems when processing extremely large images (bsc#1259528).
• CVE-2026-32259: memory allocation fails can lead to out of bound write (bsc#1259612).
• CVE-2026-32636: Denial of Service via out-of-bounds write in NewXMLTree method (bsc#1259872).
• CVE-2026-33535: Out-of-Bounds write of a zero byte in X11 display interaction (bsc#1260874).
• CVE-2026-33536: Denial of Service via out-of-bounds write (bsc#1260879).

This update for ImageMagick fixes the following issues:

• CVE-2026-24484: denial of service via multi-layer nested MVG to SVG conversion (bsc#1258790).
• CVE-2026-28493: integer overflow in the SIXEL decoder leads to out-of-bounds write (bsc#1259446).
• CVE-2026-28494: missing bounds checks in the morphology kernel parsing functions can lead to a stack buffer overflow (bsc#1259447).
• CVE-2026-28686: undersized output buffer allocation in the PCL encoder can lead to a heap buffer overflow (bsc#1259448).
• CVE-2026-28687: heap use-after-free vulnerability in the MSL decoder via a crafted MSL file (bsc#1259450).
• CVE-2026-28688: heap use-after-free in the MSL encoder when a cloned image is destroyed twice (bsc#1259451).
• CVE-2026-28689: domain='path' authorization is checked before final file open/use and allows for read/write bypass via symlink swaps (bsc#1259452).
• CVE-2026-28690: missing bounds check in the MNG encoder can lead to a stack buffer overflow (bsc#1259456).
• CVE-2026-28691: missing check in the JBIG decoder can lead to an uninitialized pointer dereference (bsc#1259455).
• CVE-2026-28692: 32-bit integer overflow in MAT decoder can lead to a heap buffer over-read (bsc#1259457).
• CVE-2026-28693: integer overflow in the DIB coder can lead to an out-of-bounds read or write (bsc#1259466).
• CVE-2026-30883: missing bounds check when encoding a PNG image can lead to a heap buffer over-write (bsc#1259467).
• CVE-2026-30929: improper use of fixed-size stack buffer in MagnifyImagecan lead to a stack buffer overflow (bsc#1259468).
• CVE-2026-30936: heap buffer overflow in WaveletDenoiseImage (bsc#1259464).
• CVE-2026-30937: heap buffer overflow in XWD encoder due to CARD32 arithmetic overflow (bsc#1259463).
• CVE-2026-31853: heap buffer overflow leads to crash in the SFW decoder of 32-bit systems when processing extremely large images (bsc#1259528).
• CVE-2026-32259: memory allocation failure in the SIXEL encoder can lead to a stack out-of-bound write (bsc#1259612).
• CVE-2026-32636: denial of service via out-of-bounds write in NewXMLTree method (bsc#1259872).
• CVE-2026-33535: out-of-Bounds write of a zero byte in X11 display interaction (bsc#1260874).
• CVE-2026-33536: denial of Service via a stack out-of-bounds write in InterpretImageFilename (bsc#1260879).
• CVE-2026-33905: denial of service via out-of-bounds read in -sample operation (bsc#1262097).

This update for GraphicsMagick fixes the following issue:

• CVE-2026-33535: Out-of-Bounds write of a zero byte in X11 display interaction (bsc#1260874).

This update for ImageMagick fixes the following issues:

• CVE-2026-32259: stack out-of-bounds write due to a memory allocation failure in the sixel encoder can lead to a crash (bsc#1259612).
• CVE-2026-32636: out-of-bounds write of a single zero byte due to bug the NewXMLTree method can lead to denial of service (bsc#1259872).
• CVE-2026-33535: out-of-bounds write of a zero byte in X11 display interaction path can lead to a crash (bsc#1260874).
• CVE-2026-33536: stack out-of-bounds write due to incorrect return value on certain platforms can lead to a denial of service (bsc#1260879).
• CVE-2026-33899: out-of-bounds write of single zero byte in XML parsing can lead to a denial of service (bsc#1262154).
• CVE-2026-33900: heap out-of-bounds write due to integer truncation in viff encoder can lead to a crash (bsc#1262156).
• CVE-2026-33901: heap buffer overflow in the MVG decoder can lead to memory corruption or a crash (bsc#1262155).
• CVE-2026-33902: stack buffer overflow in the FX expression parser can lead to a process crash (bsc#1262153).
• CVE-2026-33905: out-of-bounds read in -sample operation can lead to a denial of service (bsc#1262097).
• CVE-2026-33908: recursive execution with no depth limit imposed when processing XML files can lead to resource exhaustion and a denial of service (bsc#1262152).
• CVE-2026-34238: heap buffer overflow due to integer overflow in the despeckle operation can lead to a denial of service (bsc#1262147).
• CVE-2026-40169: out-of-bounds heap write when processing a crafted image and writing a YAML or JSON output can lead to a crash (bsc#1262150).
• CVE-2026-40183: heap out-of-bounds write in the JXL encoder can lead to a denial of service (bsc#1262145).
• CVE-2026-40310: heap out-of-bounds write in the JP2 encoder can lead to a denial of service (bsc#1262148).
• CVE-2026-40311: heap use-after-free when reading and printing values from an invalid XMP profile can lead to a denial of service (bsc#1262146).
• CVE-2026-40312: off-by-one error in the MSL decoder can lead to a crash (bsc#1262149).

It was discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-33535)

Kamil Frankowicz discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-33536)

It was discovered that ImageMagick did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-34238)

Jake Lamberson discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-40310)

Junmin Zhu discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-40311)

It was discovered that ImageMagick did not correctly handle opening certain MSL files. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly cause a denial of service. This issue affected Ubuntu 26.04 LTS. (CVE-2026-40312)

It was discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-56361)