[Pkg-gmagick-im-team] Bug#1150802: imagemagick: CVE-2026-109258 CVE-2026-109259 CVE-2026-109260 CVE-2026-109261 CVE-2026-109262 CVE-2026-109263 CVE-2026-109264 CVE-2026-109265 CVE-2026-109266 CVE-2026-109267 CVE-2026-109268 CVE-2026-109269 CVE-2026-109270 CVE-2026-109271 CVE-2026-109272 CVE-2026-109273 CVE-2026-109274 CVE-2026-109275 CVE-2026-109276 CVE-2026-109277 CVE-2026-109278 CVE-2026-109279 CVE-2026-109280 CVE-2026-109281 CVE-2026-109282
Moritz Mühlenhoff
jmm at inutil.org
Tue Oct 13 13:02:21 BST 2026
Source: imagemagick
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security
Hi,
The following vulnerabilities were published for imagemagick.
CVE-2026-109258[0]:
| ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free
| vulnerability in the fx operation that occurs when initialization of
| an FX runtime entry fails. Attackers can trigger the failed FX
| runtime initialization to cause an invalid free, resulting in memory
| corruption and application crashes.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323 (7.1.2-32)
CVE-2026-109259[1]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an
| uninitialized memory read in the TGA image decoder that can expose
| memory contents. Attackers can supply a crafted TGA image for
| processing to disclose contents of uninitialized memory from the
| ImageMagick process.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h499-883p-vph8
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/df199b79f0a1c87ca009e431f03cb387af160f77 (7.1.2-32)
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/8e809498fd328256612ee9c0ff7941bd452a0285 (7.1.2-32)
CVE-2026-109260[2]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a
| memory leak in the PNG encoder, which does not release allocated
| memory when libpng initialization fails. Attackers who can
| repeatedly trigger PNG encoding operations in which libpng
| initialization fails can exhaust memory and cause a denial of
| service.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/fd1b9c85f2634e34034d39016ed7542ac0a19930 (7.1.2-32)
CVE-2026-109261[3]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a
| memory leak in the GIF encoder because allocated memory is not
| released when color quantization fails during encoding. Attackers
| can supply images whose GIF conversion causes quantization to fail,
| leaking memory with each attempt and degrading availability.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/1c7763266cfedc635005a965169bc2ddcc650221 (7.1.2-32)
CVE-2026-109262[4]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a
| memory leak in the SVG encoder (WriteSVGImage) that fails to release
| allocated memory when handling crafted images. Attackers can supply
| crafted image files that are processed by the SVG encoder to leak
| memory and cause a denial of service through resource consumption.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/2eff6be3785d980bb5190244ad432fe6282d29e3 (7.1.2-32)
CVE-2026-109263[5]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a
| memory leak in the YUV encoder, which fails to release allocated
| memory when a specific operation fails. Attackers can supply crafted
| input that triggers the failing encoder operation, leaking memory
| and potentially exhausting resources to cause a denial of service.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/493fab0b6072787e929184761b6ab6405a9486a2 (7.1.2-32)
CVE-2026-109264[6]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains
| uncontrolled recursion in the MVG decoder that can exhaust the
| program stack. An attacker who controls a file name processed by
| ImageMagick can trigger a stack overflow that crashes the process,
| causing a denial of service.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20 (7.1.2-32)
CVE-2026-109265[7]:
| ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read
| vulnerability that allows attackers to read beyond allocated memory
| due to incorrect string termination in XMP profiles. Attackers can
| supply a crafted image containing a malformed XMP profile to trigger
| the over-read and crash the application.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jph3-37cg-79wg
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/7605c7619da77a5ff1ccf4ec159f3ec782c6bda7 (7.1.2-32)
CVE-2026-109266[8]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML
| injection vulnerability in the CIP encoder, which does not properly
| escape input-derived data when writing Cisco IP Phone XML output.
| Attackers can supply a crafted file that, when converted to CIP
| format, injects arbitrary markup into the generated XML.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3429-f84m-8qhw
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/45bb7328b36c163234f5ccb7f1d494b7c4c8c775 (7.1.2-32)
CVE-2026-109267[9]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a
| stack overflow in the MSL decoder caused by an incorrect depth check
| that fails to limit recursion. Attackers can supply a set of crafted
| MSL images that exhaust the stack when one of them is read, crashing
| the process and causing a denial of service.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683 (7.1.2-32)
CVE-2026-109268[10]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use
| after free vulnerability in the PDF writer when writing CMYK images
| with JPEG2000 compression. Attackers can supply a crafted CMYK image
| that, when written to PDF with JPEG2000 compression, causes freed
| memory to be reused, potentially crashing the process.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54 (7.1.2-32)
CVE-2026-109269[11]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an
| information disclosure vulnerability in the JPEG decoder, which
| performs a read that exposes uninitialized memory when handling
| crafted input. Attackers can supply a crafted JPEG file for
| processing to disclose uninitialized memory contents.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxrx-rjp3-27rj
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/aa104ff2e408bea23828e7a7a346f9080da4104b (7.1.2-32)
CVE-2026-109270[12]:
| ImageMagick before 7.1.2-32 contains a memory leak vulnerability in
| the -process option that allows attackers to cause unreleased memory
| allocations by supplying certain arguments. Attackers can repeatedly
| invoke the -process option with crafted arguments to gradually
| exhaust memory and degrade service availability.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f32c-2v6j-wvh5
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/da4cfd78a2ceea4cf54207834f9d60c1b9c38797 (7.1.2-32)
CVE-2026-109271[13]:
| ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free
| vulnerability in the WBINFO decoder that occurs when a memory
| allocation fails during image decoding. Attackers can supply a
| crafted image that, when decoded under memory allocation failure
| conditions, causes freed memory to be reused, crashing the
| application.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4 (7.1.2-32)
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6 (7.1.2-32)
CVE-2026-109272[14]:
| ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer
| dereference in the PostScript decoder that is triggered when a
| policy limit is reached. Attackers can supply a crafted PostScript
| file for processing to crash the application, causing a denial of
| service.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722 (7.1.2-32)
CVE-2026-109273[15]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an
| information disclosure vulnerability in the PostScript decoder,
| which allocates a buffer one byte longer than the data it decoded.
| Attackers can supply a crafted PostScript file to expose a single
| uninitialized byte of memory contents.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5j8x-vq8c-vrp9
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/5a5c2e51948fcc5d85b8d832938e2c1b4db4a699 (7.1.2-32)
CVE-2026-109274[16]:
| ImageMagick before 7.1.2-32 contains a time-of-check time-of-use
| symlink race vulnerability that allows attackers to bypass the path
| security policy when executing a magick script. Attackers can swap a
| checked path with a symlink during script execution to read files
| that the security policy is meant to block.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7q74-r26w-fwcx
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/9e789499e67dbf5c4ee9fe1b72690738c799ec73 (7.1.2-32)
CVE-2026-109275[17]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code
| injection vulnerability in the MVG decoder when a PostScript
| renderer is used. Attackers can supply a crafted MVG file that, when
| decoded, injects code into the PostScript rendering path.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226 (7.1.2-32)
CVE-2026-109276[18]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an
| incomplete cleanup flaw in the JNG decoder that fails to remove
| temporary files when processing crafted input. Attackers can submit
| crafted JNG files for processing to repeatedly leak temporary files,
| consuming disk space and degrading availability.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a (7.1.2-32)
CVE-2026-109277[19]:
| ImageMagick before 7.1.2-32 contains a policy bypass vulnerability
| in the -script operation due to missing checks on file descriptor
| handling. Attackers can use the -script operation to close file
| descriptors not opened by the current operation, circumventing
| configured security policies.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vv56-wmgw-m36w
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/ce92ae07c2ca2c20c131eaf6da6da734c1cafce0 (7.1.2-32)
CVE-2026-109278[20]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a
| memory leak in the wavelet-denoise operation, which fails to release
| allocated memory when a required resource cannot be acquired.
| Attackers can repeatedly trigger wavelet-denoise processing under
| resource-constrained conditions to leak memory and degrade service
| availability.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c (7.1.2-32)
CVE-2026-109279[21]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper
| synchronization when the security policy is accessed, so
| simultaneous reads and writes of the policy by multiple threads
| trigger a race condition that causes a heap buffer over-write. An
| attacker able to induce concurrent security policy access can crash
| the application, causing a denial of service.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8x3v-wr32-qqh4
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/12db6f04e895deae4537ead10c771a244607794a (7.1.2-32)
CVE-2026-109280[22]:
| ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free
| vulnerability in the -fx option that occurs when a memory allocation
| fails during a specific operation. Attackers who can supply crafted
| -fx expressions under memory pressure can trigger freed memory
| access, causing crashes or memory corruption.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v2x3-wpmg-c4w6
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/fb743d60700c9bc350c3d2a0b48b998bdabc466c (7.1.2-32)
CVE-2026-109281[23]:
| ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-
| read in its handling of the -fx option, where a certain -fx
| operation reads beyond the bounds of an allocated heap buffer in
| specific situations. Attackers who can get a crafted -fx expression
| processed can read out-of-bounds heap memory, potentially disclosing
| limited memory contents.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvgp-q487-j22w
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/0e82a4d0b294581186ed7b3e1dce59c858a73dba (7.1.2-32)
CVE-2026-109282[24]:
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type
| confusion flaw in the INFO, JSON and YAML encoders, where an
| internal method receives a pointer of an unexpected type when
| writing an image in a compressed format. An attacker who can cause
| such an image write can trigger a SIGABRT or SIGSEGV, crashing the
| process and causing denial of service.
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8xmr-6q99-c4x8
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/af7b85012e62fa65393277790b96c56a98d882b6 (7.1.2-32)
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-109258
https://www.cve.org/CVERecord?id=CVE-2026-109258
[1] https://security-tracker.debian.org/tracker/CVE-2026-109259
https://www.cve.org/CVERecord?id=CVE-2026-109259
[2] https://security-tracker.debian.org/tracker/CVE-2026-109260
https://www.cve.org/CVERecord?id=CVE-2026-109260
[3] https://security-tracker.debian.org/tracker/CVE-2026-109261
https://www.cve.org/CVERecord?id=CVE-2026-109261
[4] https://security-tracker.debian.org/tracker/CVE-2026-109262
https://www.cve.org/CVERecord?id=CVE-2026-109262
[5] https://security-tracker.debian.org/tracker/CVE-2026-109263
https://www.cve.org/CVERecord?id=CVE-2026-109263
[6] https://security-tracker.debian.org/tracker/CVE-2026-109264
https://www.cve.org/CVERecord?id=CVE-2026-109264
[7] https://security-tracker.debian.org/tracker/CVE-2026-109265
https://www.cve.org/CVERecord?id=CVE-2026-109265
[8] https://security-tracker.debian.org/tracker/CVE-2026-109266
https://www.cve.org/CVERecord?id=CVE-2026-109266
[9] https://security-tracker.debian.org/tracker/CVE-2026-109267
https://www.cve.org/CVERecord?id=CVE-2026-109267
[10] https://security-tracker.debian.org/tracker/CVE-2026-109268
https://www.cve.org/CVERecord?id=CVE-2026-109268
[11] https://security-tracker.debian.org/tracker/CVE-2026-109269
https://www.cve.org/CVERecord?id=CVE-2026-109269
[12] https://security-tracker.debian.org/tracker/CVE-2026-109270
https://www.cve.org/CVERecord?id=CVE-2026-109270
[13] https://security-tracker.debian.org/tracker/CVE-2026-109271
https://www.cve.org/CVERecord?id=CVE-2026-109271
[14] https://security-tracker.debian.org/tracker/CVE-2026-109272
https://www.cve.org/CVERecord?id=CVE-2026-109272
[15] https://security-tracker.debian.org/tracker/CVE-2026-109273
https://www.cve.org/CVERecord?id=CVE-2026-109273
[16] https://security-tracker.debian.org/tracker/CVE-2026-109274
https://www.cve.org/CVERecord?id=CVE-2026-109274
[17] https://security-tracker.debian.org/tracker/CVE-2026-109275
https://www.cve.org/CVERecord?id=CVE-2026-109275
[18] https://security-tracker.debian.org/tracker/CVE-2026-109276
https://www.cve.org/CVERecord?id=CVE-2026-109276
[19] https://security-tracker.debian.org/tracker/CVE-2026-109277
https://www.cve.org/CVERecord?id=CVE-2026-109277
[20] https://security-tracker.debian.org/tracker/CVE-2026-109278
https://www.cve.org/CVERecord?id=CVE-2026-109278
[21] https://security-tracker.debian.org/tracker/CVE-2026-109279
https://www.cve.org/CVERecord?id=CVE-2026-109279
[22] https://security-tracker.debian.org/tracker/CVE-2026-109280
https://www.cve.org/CVERecord?id=CVE-2026-109280
[23] https://security-tracker.debian.org/tracker/CVE-2026-109281
https://www.cve.org/CVERecord?id=CVE-2026-109281
[24] https://security-tracker.debian.org/tracker/CVE-2026-109282
https://www.cve.org/CVERecord?id=CVE-2026-109282
Please adjust the affected versions in the BTS as needed.
More information about the Pkg-gmagick-im-team
mailing list