Skip to content
OpenAdvisories
High ALAS2-2026-3373 6 CVEs

Important: ImageMagick security update (Amazon Linux 2)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-53463: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when passing incorrect arguments in the distort operation a null pointer deference will occur. This issue has been patched in versions 6.9.13-50 and 7.1.2-25. CVE-2026-53462: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25. CVE-2026-53460: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25. CVE-2026-49218: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24. CVE-2026-48994: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24. CVE-2026-48734: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. This issue has been patched in versions 6.9.13-49 and 7.1.2-24.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 ImageMagick 0:6.9.10.97-1.amzn2.0.30
Amazon Linux · 2 ImageMagick-c++ 0:6.9.10.97-1.amzn2.0.30
Amazon Linux · 2 ImageMagick-c++-devel 0:6.9.10.97-1.amzn2.0.30
Amazon Linux · 2 ImageMagick-debuginfo 0:6.9.10.97-1.amzn2.0.30
Amazon Linux · 2 ImageMagick-devel 0:6.9.10.97-1.amzn2.0.30
Amazon Linux · 2 ImageMagick-doc 0:6.9.10.97-1.amzn2.0.30
Amazon Linux · 2 ImageMagick-perl 0:6.9.10.97-1.amzn2.0.30

Vulnerabilities 6

  • High 7.5
    CVE-2026-49218

    ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 7.5
    CVE-2026-53460

    ImageMagick: Policy Bypass can trigger out-of-Memory condition

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue ha…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.9
    CVE-2026-48994

    ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.9
    CVE-2026-53462

    ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent fails

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issu…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-48734

    ImageMagick: Stack Overflow in MVG decoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. This issue has been patch…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 4.3
    CVE-2026-53463

    ImageMagick: Null Pointer Dereference in distort operation when passing incorrect arguments

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when passing incorrect arguments in the distort operation a null pointer deference will occur. This issue has been patched…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48734.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48994.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-49218.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53460.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53462.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53463.html