Skip to content
Heist/ feed
LowFix available

ImageMagick security update

Type: advisorySource: OSV1 source record

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves. Security Fix(es): ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions 7.1.2-31 and 6.9.13-56.(CVE-2026-93586) ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56.(CVE-2026-93587) ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled

Announced Source revision 1
Original source ↗

OESA-2026-4017

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:OESA-2026-4017

ImageMagick

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
7.1.2.31-1.oe2403sp4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

ImageMagick

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
6.9.13.56-1.oe2003sp4

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

ImageMagick

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
7.1.2.31-1.oe2203sp4

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

ImageMagick

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
7.1.2.31-1.oe2403sp1

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

ImageMagick

Source reference: /affected/4/package/name

Affected versions
Not stated in this record
Fixed versions
7.1.2.31-1.oe2403sp3

Source reference: /affected/4/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "7.1.2.31-1.oe2403sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "ImageMagick",
      "purl": "pkg:rpm/openEuler/ImageMagick&distro=openEuler-24.03-LTS-SP4",
      "ecosystem": "openEuler:24.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"
    },
    "ecosystem_specific": {
      "src": [
        "ImageMagick-7.1.2.31-1.oe2403sp4.src.rpm"
      ],
      "noarch": [
        "ImageMagick-help-7.1.2.31-1.oe2403sp4.noarch.rpm"
      ],
      "x86_64": [
        "ImageMagick-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp4.x86_64.rpm"
      ],
      "aarch64": [
        "ImageMagick-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp4.aarch64.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "6.9.13.56-1.oe2003sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "ImageMagick",
      "purl": "pkg:rpm/openEuler/ImageMagick&distro=openEuler-20.03-LTS-SP4",
      "ecosystem": "openEuler:20.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"
    },
    "ecosystem_specific": {
      "src": [
        "ImageMagick-6.9.13.56-1.oe2003sp4.src.rpm"
      ],
      "noarch": [
        "ImageMagick-help-6.9.13.56-1.oe2003sp4.noarch.rpm"
      ],
      "x86_64": [
        "ImageMagick-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-c++-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-c++-devel-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-debuginfo-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-debugsource-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-devel-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-perl-6.9.13.56-1.oe2003sp4.x86_64.rpm"
      ],
      "aarch64": [
        "ImageMagick-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-c++-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-c++-devel-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-debuginfo-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-debugsource-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-devel-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-perl-6.9.13.56-1.oe2003sp4.aarch64.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "7.1.2.31-1.oe2203sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "ImageMagick",
      "purl": "pkg:rpm/openEuler/ImageMagick&distro=openEuler-22.03-LTS-SP4",
      "ecosystem": "openEuler:22.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"
    },
    "ecosystem_specific": {
      "src": [
        "ImageMagick-7.1.2.31-1.oe2203sp4.src.rpm"
      ],
      "noarch": [
        "ImageMagick-help-7.1.2.31-1.oe2203sp4.noarch.rpm"
      ],
      "x86_64": [
        "ImageMagick-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2203sp4.x86_64.rpm"
      ],
      "aarch64": [
        "ImageMagick-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2203sp4.aarch64.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "7.1.2.31-1.oe2403sp1"
          }
        ]
      }
    ],
    "package": {
      "name": "ImageMagick",
      "purl": "pkg:rpm/openEuler/ImageMagick&distro=openEuler-24.03-LTS-SP1",
      "ecosystem": "openEuler:24.03-LTS-SP1"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"
    },
    "ecosystem_specific": {
      "src": [
        "ImageMagick-7.1.2.31-1.oe2403sp1.src.rpm"
      ],
      "noarch": [
        "ImageMagick-help-7.1.2.31-1.oe2403sp1.noarch.rpm"
      ],
      "x86_64": [
        "ImageMagick-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp1.x86_64.rpm"
      ],
      "aarch64": [
        "ImageMagick-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp1.aarch64.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "7.1.2.31-1.oe2403sp3"
          }
        ]
      }
    ],
    "package": {
      "name": "ImageMagick",
      "purl": "pkg:rpm/openEuler/ImageMagick&distro=openEuler-24.03-LTS-SP3",
      "ecosystem": "openEuler:24.03-LTS-SP3"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"
    },
    "ecosystem_specific": {
      "src": [
        "ImageMagick-7.1.2.31-1.oe2403sp3.src.rpm"
      ],
      "noarch": [
        "ImageMagick-help-7.1.2.31-1.oe2403sp3.noarch.rpm"
      ],
      "x86_64": [
        "ImageMagick-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp3.x86_64.rpm"
      ],
      "aarch64": [
        "ImageMagick-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp3.aarch64.rpm"
      ]
    }
  }
]

Publisher severity

low

Source reference: /database_specific/severity

Event
#14658 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement