Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-23952: NULL pointer dereference in MSL (Magick Scripting Language) parser when processing <comment> tag before any image is loaded. CVE-2026-23876: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue. CVE-2026-23874: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-13 have a stack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format. Version 7.1.2-13 fixes the issue.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ImageMagick | 0:6.9.10.97-1.amzn2.0.20 |
| Amazon Linux · 2 | ImageMagick-c++ | 0:6.9.10.97-1.amzn2.0.20 |
| Amazon Linux · 2 | ImageMagick-c++-devel | 0:6.9.10.97-1.amzn2.0.20 |
| Amazon Linux · 2 | ImageMagick-debuginfo | 0:6.9.10.97-1.amzn2.0.20 |
| Amazon Linux · 2 | ImageMagick-devel | 0:6.9.10.97-1.amzn2.0.20 |
| Amazon Linux · 2 | ImageMagick-doc | 0:6.9.10.97-1.amzn2.0.20 |
| Amazon Linux · 2 | ImageMagick-perl | 0:6.9.10.97-1.amzn2.0.20 |
Vulnerabilities 3
-
High 8.1
Heap buffer overflow with attacker-controlled data in XBM parser
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data p…
-
Medium 6.5
ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images …
-
Medium 5.5
ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-13 have a stack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format. Version 7.1…