{"id":"CVE-2026-105083","aliases":["DEBIAN-CVE-2026-105083","EUVD-2026-91870","GHSA-9r9r-c7x8-qp3r","GHSA-jjp4-3fwf-393j","SUSE-SU-2026:4691-1","SUSE-SU-2026:4799-1","UBUNTU-CVE-2026-105083","openSUSE-SU-2026:12078-1"],"status":"published","title":"ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE","description":"ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']\u003e' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.","severity":{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00113,"percentile":0.01418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2026-10-03T01:11:12Z","modified":"2026-11-04T23:00:25Z","fixes":[{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.11.60+dfsg-1.6+deb12u15"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:7.1.1.43+dfsg1-1+deb13u14"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:7.1.2.33+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.6+deb12u15"}]}],"versions":["8:6.9.11.60+dfsg-1.6","8:6.9.11.60+dfsg-1.6+deb12u1","8:6.9.11.60+dfsg-1.6+deb12u10","8:6.9.11.60+dfsg-1.6+deb12u11","8:6.9.11.60+dfsg-1.6+deb12u12","8:6.9.11.60+dfsg-1.6+deb12u13","8:6.9.11.60+dfsg-1.6+deb12u14","8:6.9.11.60+dfsg-1.6+deb12u2","8:6.9.11.60+dfsg-1.6+deb12u3","8:6.9.11.60+dfsg-1.6+deb12u4","8:6.9.11.60+dfsg-1.6+deb12u5","8:6.9.11.60+dfsg-1.6+deb12u6","8:6.9.11.60+dfsg-1.6+deb12u7","8:6.9.11.60+dfsg-1.6+deb12u8","8:6.9.11.60+dfsg-1.6+deb12u9"]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.1.43+dfsg1-1+deb13u14"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.43+dfsg1-1+deb13u1","8:7.1.1.43+dfsg1-1+deb13u10","8:7.1.1.43+dfsg1-1+deb13u11","8:7.1.1.43+dfsg1-1+deb13u12","8:7.1.1.43+dfsg1-1+deb13u13","8:7.1.1.43+dfsg1-1+deb13u2","8:7.1.1.43+dfsg1-1+deb13u3","8:7.1.1.43+dfsg1-1+deb13u4","8:7.1.1.43+dfsg1-1+deb13u5","8:7.1.1.43+dfsg1-1+deb13u6","8:7.1.1.43+dfsg1-1+deb13u7","8:7.1.1.43+dfsg1-1+deb13u8","8:7.1.1.43+dfsg1-1+deb13u9"]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.2.33+dfsg1-1"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.46+dfsg1-1","8:7.1.1.47+dfsg1-1","8:7.1.1.47+dfsg1-2","8:7.1.2.1+dfsg1-1","8:7.1.2.12+dfsg1-1","8:7.1.2.13+dfsg1-1","8:7.1.2.15+dfsg1-1","8:7.1.2.15+dfsg1-2","8:7.1.2.16+dfsg1-1","8:7.1.2.18+dfsg1-1","8:7.1.2.19+dfsg1-1","8:7.1.2.21+dfsg1-1","8:7.1.2.23+dfsg1-1","8:7.1.2.24+dfsg1-1","8:7.1.2.25+dfsg1-1","8:7.1.2.25+dfsg1-2","8:7.1.2.26+dfsg1-1","8:7.1.2.27+dfsg1-1","8:7.1.2.29+dfsg2-1","8:7.1.2.3+dfsg1-1","8:7.1.2.31+dfsg1-1","8:7.1.2.7+dfsg1-1","8:7.1.2.8+dfsg1-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.43-150700.3.84.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.43-150700.3.84.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.9-150400.6.122.1"}]}],"bundled":37},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3","8:6.7.7.10-6ubuntu3.1","8:6.7.7.10-6ubuntu3.2","8:6.7.7.10-6ubuntu3.3","8:6.7.7.10-6ubuntu3.4","8:6.7.7.10-6ubuntu3.5","8:6.7.7.10-6ubuntu3.6","8:6.7.7.10-6ubuntu3.7","8:6.7.7.10-6ubuntu3.8","8:6.7.7.10-6ubuntu3.9","8:6.7.7.10-6ubuntu3.11","8:6.7.7.10-6ubuntu3.12","8:6.7.7.10-6ubuntu3.13","8:6.7.7.10-6ubuntu3.13+esm1","8:6.7.7.10-6ubuntu3.13+esm2","8:6.7.7.10-6ubuntu3.13+esm3","8:6.7.7.10-6ubuntu3.13+esm4","8:6.7.7.10-6ubuntu3.13+esm5","8:6.7.7.10-6ubuntu3.13+esm6","8:6.7.7.10-6ubuntu3.13+esm7","8:6.7.7.10-6ubuntu3.13+esm8","8:6.7.7.10-6ubuntu3.13+esm9","8:6.7.7.10-6ubuntu3.13+esm10","8:6.7.7.10-6ubuntu3.13+esm11","8:6.7.7.10-6ubuntu3.13+esm12","8:6.7.7.10-6ubuntu3.13+esm13","8:6.7.7.10-6ubuntu3.13+esm14","8:6.7.7.10-6ubuntu3.13+esm15","8:6.7.7.10-6ubuntu3.13+esm16","8:6.7.7.10-6ubuntu3.13+esm17","8:6.7.7.10-6ubuntu3.13+esm18","8:6.7.7.10-6ubuntu3.13+esm19","8:6.7.7.10-6ubuntu3.13+esm20","8:6.7.7.10-6ubuntu3.13+esm21","8:6.7.7.10-6ubuntu3.13+esm22","8:6.7.7.10-6ubuntu3.13+esm23","8:6.7.7.10-6ubuntu3.13+esm24","8:6.7.7.10-6ubuntu3.13+esm25","8:6.7.7.10-6ubuntu3.13+esm26","8:6.7.7.10-6ubuntu3.13+esm27"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5","8:6.8.9.9-7ubuntu5.1","8:6.8.9.9-7ubuntu5.2","8:6.8.9.9-7ubuntu5.3","8:6.8.9.9-7ubuntu5.4","8:6.8.9.9-7ubuntu5.5","8:6.8.9.9-7ubuntu5.6","8:6.8.9.9-7ubuntu5.7","8:6.8.9.9-7ubuntu5.8","8:6.8.9.9-7ubuntu5.9","8:6.8.9.9-7ubuntu5.11","8:6.8.9.9-7ubuntu5.12","8:6.8.9.9-7ubuntu5.13","8:6.8.9.9-7ubuntu5.14","8:6.8.9.9-7ubuntu5.15","8:6.8.9.9-7ubuntu5.16","8:6.8.9.9-7ubuntu5.16+esm1","8:6.8.9.9-7ubuntu5.16+esm2","8:6.8.9.9-7ubuntu5.16+esm3","8:6.8.9.9-7ubuntu5.16+esm4","8:6.8.9.9-7ubuntu5.16+esm5","8:6.8.9.9-7ubuntu5.16+esm6","8:6.8.9.9-7ubuntu5.16+esm7","8:6.8.9.9-7ubuntu5.16+esm8","8:6.8.9.9-7ubuntu5.16+esm9","8:6.8.9.9-7ubuntu5.16+esm10","8:6.8.9.9-7ubuntu5.16+esm11","8:6.8.9.9-7ubuntu5.16+esm12","8:6.8.9.9-7ubuntu5.16+esm13","8:6.8.9.9-7ubuntu5.16+esm14","8:6.8.9.9-7ubuntu5.16+esm15","8:6.8.9.9-7ubuntu5.16+esm16","8:6.8.9.9-7ubuntu5.16+esm17","8:6.8.9.9-7ubuntu5.16+esm18","8:6.8.9.9-7ubuntu5.16+esm19","8:6.8.9.9-7ubuntu5.16+esm20","8:6.8.9.9-7ubuntu5.16+esm21","8:6.8.9.9-7ubuntu5.16+esm22","8:6.8.9.9-7ubuntu5.16+esm23","8:6.8.9.9-7ubuntu5.16+esm24","8:6.8.9.9-7ubuntu5.16+esm25","8:6.8.9.9-7ubuntu5.16+esm26"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.7.4+dfsg-16ubuntu2","8:6.9.7.4+dfsg-16ubuntu3","8:6.9.7.4+dfsg-16ubuntu4","8:6.9.7.4+dfsg-16ubuntu5","8:6.9.7.4+dfsg-16ubuntu6","8:6.9.7.4+dfsg-16ubuntu6.2","8:6.9.7.4+dfsg-16ubuntu6.3","8:6.9.7.4+dfsg-16ubuntu6.4","8:6.9.7.4+dfsg-16ubuntu6.7","8:6.9.7.4+dfsg-16ubuntu6.8","8:6.9.7.4+dfsg-16ubuntu6.9","8:6.9.7.4+dfsg-16ubuntu6.11","8:6.9.7.4+dfsg-16ubuntu6.12","8:6.9.7.4+dfsg-16ubuntu6.13","8:6.9.7.4+dfsg-16ubuntu6.14","8:6.9.7.4+dfsg-16ubuntu6.15","8:6.9.7.4+dfsg-16ubuntu6.15+esm1","8:6.9.7.4+dfsg-16ubuntu6.15+esm2","8:6.9.7.4+dfsg-16ubuntu6.15+esm3","8:6.9.7.4+dfsg-16ubuntu6.15+esm4","8:6.9.7.4+dfsg-16ubuntu6.15+esm5","8:6.9.7.4+dfsg-16ubuntu6.15+esm6","8:6.9.7.4+dfsg-16ubuntu6.15+esm7","8:6.9.7.4+dfsg-16ubuntu6.15+esm8","8:6.9.7.4+dfsg-16ubuntu6.15+esm9","8:6.9.7.4+dfsg-16ubuntu6.15+esm10","8:6.9.7.4+dfsg-16ubuntu6.15+esm11","8:6.9.7.4+dfsg-16ubuntu6.15+esm12","8:6.9.7.4+dfsg-16ubuntu6.15+esm13","8:6.9.7.4+dfsg-16ubuntu6.15+esm14","8:6.9.7.4+dfsg-16ubuntu6.15+esm15","8:6.9.7.4+dfsg-16ubuntu6.15+esm16","8:6.9.7.4+dfsg-16ubuntu6.15+esm17","8:6.9.7.4+dfsg-16ubuntu6.15+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.10.23+dfsg-2.1ubuntu3","8:6.9.10.23+dfsg-2.1ubuntu8","8:6.9.10.23+dfsg-2.1ubuntu9","8:6.9.10.23+dfsg-2.1ubuntu10","8:6.9.10.23+dfsg-2.1ubuntu11","8:6.9.10.23+dfsg-2.1ubuntu11.1","8:6.9.10.23+dfsg-2.1ubuntu11.2","8:6.9.10.23+dfsg-2.1ubuntu11.4","8:6.9.10.23+dfsg-2.1ubuntu11.4+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.5","8:6.9.10.23+dfsg-2.1ubuntu11.6","8:6.9.10.23+dfsg-2.1ubuntu11.6+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.7","8:6.9.10.23+dfsg-2.1ubuntu11.7+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.9+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.10","8:6.9.10.23+dfsg-2.1ubuntu11.10+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm1","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm3","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm4","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm5","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm6","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm7","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm8","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm9","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm10","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm11","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm12","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm13","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm14","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm15","8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.11.60+dfsg-1ubuntu1","8:6.9.11.60+dfsg-1.3","8:6.9.11.60+dfsg-1.3build1","8:6.9.11.60+dfsg-1.3build2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm1","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm3","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm4","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm6","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm7","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm8","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm9","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm11","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm12","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm13","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm14","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.11.60+dfsg-1.6ubuntu1","8:6.9.12.98+dfsg1-5","8:6.9.12.98+dfsg1-5.2build1","8:6.9.12.98+dfsg1-5.2build2","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm2","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm3","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm4","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm5","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm6","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm7","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm8","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm10","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm11","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm12","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm13","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm14","8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:7.1.2.18+dfsg1-1","8:7.1.2.25+dfsg1-2","8:7.1.2.27+dfsg1-1","8:7.1.2.31+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:7.1.2.3+dfsg1-1","8:7.1.2.8+dfsg1-1","8:7.1.2.12+dfsg1-1","8:7.1.2.13+dfsg1-1","8:7.1.2.15+dfsg1-1","8:7.1.2.16+dfsg1-1","8:7.1.2.18+dfsg1-1","8:7.1.2.18+dfsg1-1ubuntu0.1~esm1","8:7.1.2.18+dfsg1-1ubuntu0.1~esm2","8:7.1.2.18+dfsg1-1ubuntu0.1~esm3","8:7.1.2.18+dfsg1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.32-1.1"}]}],"bundled":22}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jjp4-3fwf-393j","tags":["vendor-advisory","Vendor Advisory","advisory","report"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/1926ccf119141c26274c120d1899dffae19b0c71","tags":["patch","Patch","fix","report"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/399d4bd3b081f44c7fef78153f65e8cdebed9f1a","tags":["patch","Patch","fix","report"]},{"url":"https://github.com/ImageMagick/ImageMagick6/commit/da6022b2efe6cce8a2fd8f9e51188a45a3b9d558","tags":["patch","Patch","fix","report"]},{"url":"https://github.com/ImageMagick/ImageMagick6/commit/402ebc5353e569234908962cbdf451531ff66a57","tags":["patch","Patch","fix","report"]},{"url":"https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/MagickCore/policy.c#L1138-L1145","tags":["technical-description","Product","article","report"]},{"url":"https://github.com/ImageMagick/ImageMagick","tags":["product","Product","package","report"]},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-security-policy-bypass-via-policy-xml-doctype","tags":["third-party-advisory","Patch","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105083","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9r9r-c7x8-qp3r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105083.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105083","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264691-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268113","tags":["report"]},{"url":"https://bugzilla.suse.com/1268117","tags":["report"]},{"url":"https://bugzilla.suse.com/1279696","tags":["report"]},{"url":"https://bugzilla.suse.com/1279711","tags":["report"]},{"url":"https://bugzilla.suse.com/1279794","tags":["report"]},{"url":"https://bugzilla.suse.com/1279797","tags":["report"]},{"url":"https://bugzilla.suse.com/1281909","tags":["report"]},{"url":"https://bugzilla.suse.com/1281910","tags":["report"]},{"url":"https://bugzilla.suse.com/1281911","tags":["report"]},{"url":"https://bugzilla.suse.com/1281912","tags":["report"]},{"url":"https://bugzilla.suse.com/1281913","tags":["report"]},{"url":"https://bugzilla.suse.com/1284217","tags":["report"]},{"url":"https://bugzilla.suse.com/1284661","tags":["report"]},{"url":"https://bugzilla.suse.com/1284662","tags":["report"]},{"url":"https://bugzilla.suse.com/1284663","tags":["report"]},{"url":"https://bugzilla.suse.com/1284664","tags":["report"]},{"url":"https://bugzilla.suse.com/1284665","tags":["report"]},{"url":"https://bugzilla.suse.com/1284667","tags":["report"]},{"url":"https://bugzilla.suse.com/1284668","tags":["report"]},{"url":"https://bugzilla.suse.com/1284669","tags":["report"]},{"url":"https://bugzilla.suse.com/1284671","tags":["report"]},{"url":"https://bugzilla.suse.com/1284672","tags":["report"]},{"url":"https://bugzilla.suse.com/1284673","tags":["report"]},{"url":"https://bugzilla.suse.com/1284674","tags":["report"]},{"url":"https://bugzilla.suse.com/1284675","tags":["report"]},{"url":"https://bugzilla.suse.com/1284677","tags":["report"]},{"url":"https://bugzilla.suse.com/1284678","tags":["report"]},{"url":"https://bugzilla.suse.com/1284681","tags":["report"]},{"url":"https://bugzilla.suse.com/1284682","tags":["report"]},{"url":"https://bugzilla.suse.com/1284683","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93590","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264799-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1284680","tags":["report"]},{"url":"https://bugzilla.suse.com/1285071","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109278","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-105083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105083","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106569","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-105083","title":"ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE","description":"ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']\u003e' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.","status":"published","published":"2026-10-03T01:11:12.822Z","modified":"2026-10-05T20:30:01.36Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-91870","description":"ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']\u003e' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.","status":"published","published":"2026-10-03T01:11:12Z","modified":"2026-10-05T20:30:01Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T17:27:39.05741Z"}],"ghsa":[{"id":"GHSA-9r9r-c7x8-qp3r","title":"ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in...","description":"ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']\u003e' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.","status":"published","published":"2026-10-03T03:31:32Z","modified":"2026-10-03T03:31:44Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:12:44.258575Z"}],"nvd":[{"id":"CVE-2026-105083","description":"ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']\u003e' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.","status":"published","published":"2026-10-03T02:17:18.17Z","modified":"2026-10-14T18:55:49.56Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"CVE-2026-105083","title":"ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE","description":"ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']\u003e' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.","status":"published","published":"2026-10-03T01:11:12.822Z","modified":"2026-10-28T10:51:00.914373508Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"DEBIAN-CVE-2026-105083","description":"ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']\u003e' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.","status":"published","published":"2026-10-03T02:17:18.17Z","modified":"2026-11-04T23:00:25.071393185Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-04T23:09:59.08306Z"},{"id":"UBUNTU-CVE-2026-105083","description":"ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']\u003e' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.","status":"published","published":"2026-10-03T02:17:00Z","modified":"2026-10-17T12:58:43.290288889Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"openSUSE-SU-2026:12078-1","title":"ImageMagick-7.1.2.32-1.1 on GA media","description":"These are all security issues fixed in the ImageMagick-7.1.2.32-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-09T17:23:13.015364607Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4691-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2026-86420: Denial of Service due to memory budget exhaustion (bsc#1279696).\n- CVE-2026-86421: Denial of Service via memory leak in MSL decoder (bsc#1279711).\n- CVE-2026-86423: Denial of service via heap-use-after-free in PerlMagick's GetList method (bsc#1279794).\n- CVE-2026-86425: Denial of Service due to heap-use-after-free vulnerability (bsc#1279797).\n- CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).\n- CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a denial of\n  service (bsc#1281909).\n- CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).\n- CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).\n- CVE-2026-93590: failure to perform policy checks during buffer allocation for image pixels in the UHDR encoder can\n  lead to denial of service (bsc#1281913).\n- CVE-2026-105083: security policy not applied when a user changes the DOCTYPE in the `policy.xml` file to something\n  else that is valid xml (bsc#1284217).\n- CVE-2026-106564: a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to\n  crash (bsc#1284661).\n- CVE-2026-106565: a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop\n  (bsc#1284662).\n- CVE-2026-106566: delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a\n  local privileged workflow to overwrite a file with random data (bsc#1284663).\n- CVE-2026-106567: a crafted PSD file can trigger an integer-conversion error in the PSD decoder, causing an infinite\n  loop and DoS (bsc#1284664).\n- CVE-2026-106568: a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop\n  (bsc#1284665).\n- CVE-2026-106570: an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache\n  server and exhaust its available connections, causing a DoS (bsc#1284667).\n- CVE-2026-106571: a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write\n  beyond a heap buffer, crashing the server process (bsc#1284668).\n- CVE-2026-106572: a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call\n  stack and terminate the process (bsc#1284669).\n- CVE-2026-106573: a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-\n  running operation (bsc#1284671).\n- CVE-2026-106574: a client connected to the distributed pixel cache server can send crafted pixel data that triggers a\n  heap buffer overwrite and crash the server (bsc#1284672).\n- CVE-2026-106575: a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated\n  processing to exhaust available file descriptors (bsc#1284673).\n- CVE-2026-106576: a crafted XMP profile can trigger excessive work while the parser determines a rational value's\n  numerator and denominator, causing a DoS (bsc#1284674).\n- CVE-2026-106577: unescaped or untrimmed values can inject code into output generated by PostScript coders\n  (bsc#1284675).\n- CVE-2026-106578: a crafted image can cause an invalid memory free in the MVG decoder and crash the process\n  (bsc#1284677).\n- CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially\n  allowing data prohibited by the policy to be read (bsc#1284678).\n- CVE-2026-107208: a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an\n  ordinary exception, terminating the image-processing process (bsc#1284681).\n- CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit\n  can cause a crash (bsc#1284682).\n- CVE-2026-107210: a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the\n  configured security-policy limit (bsc#1284683).\n","status":"published","published":"2026-10-16T08:42:22Z","modified":"2026-10-17T10:00:04.121727353Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4799-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).\n- CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a denial of\n  service (bsc#1281909).\n- CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).\n- CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).\n- CVE-2026-105083: security policy not applied when a user changes the DOCTYPE in the `policy.xml` file to something\n  else that is valid xml (bsc#1284217).\n- CVE-2026-106565: a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop\n  (bsc#1284662).\n- CVE-2026-106566: delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a\n  local privileged workflow to overwrite a file with random data (bsc#1284663).\n- CVE-2026-106567: a crafted PSD file can trigger an integer-conversion error in the PSD decoder, causing an infinite\n  loop and DoS (bsc#1284664).\n- CVE-2026-106568: a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop\n  (bsc#1284665).\n- CVE-2026-106570: an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache\n  server and exhaust its available connections, causing a DoS (bsc#1284667).\n- CVE-2026-106571: a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write\n  beyond a heap buffer, crashing the server process (bsc#1284668).\n- CVE-2026-106572: a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call\n  stack and terminate the process (bsc#1284669).\n- CVE-2026-106573: a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-\n  running operation (bsc#1284671).\n- CVE-2026-106574: a client connected to the distributed pixel cache server can send crafted pixel data that triggers a\n  heap buffer overwrite and crash the server (bsc#1284672).\n- CVE-2026-106575: a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated\n  processing to exhaust available file descriptors (bsc#1284673).\n- CVE-2026-106577: unescaped or untrimmed values can inject code into output generated by PostScript coders\n  (bsc#1284675).\n- CVE-2026-106578: a crafted image can cause an invalid memory free in the MVG decoder and crash the process\n  (bsc#1284677).\n- CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially\n  allowing data prohibited by the policy to be read (bsc#1284678).\n- CVE-2026-106580: a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read\n  data that policy should deny and can also cause a crash (bsc#1284680).\n- CVE-2026-107208: a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an\n  ordinary exception, terminating the image-processing process (bsc#1284681).\n- CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit\n  can cause a crash (bsc#1284682).\n- CVE-2026-107210: a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the\n  configured security-policy limit (bsc#1284683).\n- CVE-2026-109259: Information disclosure via crafted TGA image (bsc#1285071).\n- CVE-2026-109260: Denial of Service via memory leak in PNG encoder (bsc#1285071).\n- CVE-2026-109261: Denial of Service via memory leak in GIF encoder (bsc#1285071).\n- CVE-2026-109262: Denial of Service via memory leak in SVG encoder (bsc#1285071).\n- CVE-2026-109263: Denial of Service via memory leak in YUV encoder (bsc#1285071).\n- CVE-2026-109266: XML injection vulnerability in the CIP encoder (bsc#1285071).\n- CVE-2026-109268: Denial of Service via use-after-free in PDF writer (bsc#1285071).\n- CVE-2026-109269: Information disclosure via crafted JPEG file (bsc#1285071).\n- CVE-2026-109270: Denial of Service via memory leak in the -process option (bsc#1285071).\n- CVE-2026-109273: Information disclosure via crafted PostScript file (bsc#1285071).\n- CVE-2026-109275: Code injection via crafted MVG file (bsc#1285071).\n- CVE-2026-109276: Denial of Service via temporary file leak in JNG decoder (bsc#1285071).\n- CVE-2026-109277: Security policy bypass via -script operation (bsc#1285071).\n- CVE-2026-109278: Denial of Service via memory leak in wavelet-denoise operation (bsc#1285071).\n","status":"published","published":"2026-10-21T07:57:03Z","modified":"2026-10-21T20:02:15.439302894Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}