Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-47166: An attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6gxq-f64p-5w6f) CVE-2026-47165: The distributed pixel cache was originally designed to operate without a challenge-response authentication model. However, given today's heightened security expectations, we have changed our implementation. CVE-2026-46693: An attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met. (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4g75-9r48-jf92) CVE-2026-46692: An attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process. (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p93h-f2jc-477j) CVE-2026-46559: An incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-533m-3wf6-c33v) CVE-2026-46523: A crafted MSL image can trigger a heap-use-after-free. (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q) CVE-2026-46522: Due to a missing check in the MIFF decoder a crafted file could cause an infinite loop resulting in CPU exhaustion. CVE-2026-46521: When using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jcqp-6r6f-3mfx) CVE-2026-46520: When reading multiple images with different dimensions an out of bounds heap write can occur. (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5) CVE-2026-45664: Because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. CVE-2026-45624: When performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific arguments. CVE-2026-45359: An invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation CVE-2026-45358: An of by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr6r-hmj8-pr7r) CVE-2026-45031: Due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx) CVE-2026-42326: When writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte. (as per: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7wff-wpr6-vmhm)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ImageMagick | 0:6.9.10.97-1.amzn2.0.29 |
| Amazon Linux · 2 | ImageMagick-c++ | 0:6.9.10.97-1.amzn2.0.29 |
| Amazon Linux · 2 | ImageMagick-c++-devel | 0:6.9.10.97-1.amzn2.0.29 |
| Amazon Linux · 2 | ImageMagick-debuginfo | 0:6.9.10.97-1.amzn2.0.29 |
| Amazon Linux · 2 | ImageMagick-devel | 0:6.9.10.97-1.amzn2.0.29 |
| Amazon Linux · 2 | ImageMagick-doc | 0:6.9.10.97-1.amzn2.0.29 |
| Amazon Linux · 2 | ImageMagick-perl | 0:6.9.10.97-1.amzn2.0.29 |
Vulnerabilities 15
-
High 7.5
ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched …
-
High 7.5CVE-2026-46522 Public exploit
ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versi…
-
Medium 6.2
ImageMagick: Use-After-Free in MSL decoder.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue.
-
Medium 5.7
ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected compo…
-
Medium 5.7
ImageMagick: Heap Buffer Over-Read in distributed pixel cache server
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process.…
-
Medium 5.5
ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has be…
-
Medium 5.3
ImageMagick: Policy Bypass in PSD decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a P…
-
Medium 5.3
ImageMagick: Out-of-Bounds Read of a single byte in meta encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. This issue h…
-
Medium 5.3
ImageMagick: Policy Bypass in MNG coder could
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allo…
-
Medium 5.1
ImageMagick: Heap Buffer Over-Read in IPTC encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte. This issue has…
-
Medium 5.1
ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific argument…
-
Medium 4.1
ImageMagick: Heap Buffer Over-Write in distributed pixel cache server
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process…
-
Medium 4.1
ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when …
-
Medium 4.1
ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challenge–response authentication model. This has…
-
Medium 4.0
ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. T…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-42326.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45031.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45358.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45359.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45624.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45664.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46520.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46521.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46522.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46523.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46559.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46692.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46693.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-47165.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-47166.html