Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-56379: ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering. CVE-2026-56378: ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte. CVE-2026-56371: ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed. CVE-2026-56370: ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution. CVE-2026-56368: ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ImageMagick | 0:6.9.10.97-1.amzn2.0.31 |
| Amazon Linux · 2 | ImageMagick-c++ | 0:6.9.10.97-1.amzn2.0.31 |
| Amazon Linux · 2 | ImageMagick-c++-devel | 0:6.9.10.97-1.amzn2.0.31 |
| Amazon Linux · 2 | ImageMagick-debuginfo | 0:6.9.10.97-1.amzn2.0.31 |
| Amazon Linux · 2 | ImageMagick-devel | 0:6.9.10.97-1.amzn2.0.31 |
| Amazon Linux · 2 | ImageMagick-doc | 0:6.9.10.97-1.amzn2.0.31 |
| Amazon Linux · 2 | ImageMagick-perl | 0:6.9.10.97-1.amzn2.0.31 |
Vulnerabilities 5
-
High 8.1
ImageMagick - Command Injection via SVG Decoder
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that …
-
Medium 5.3
ImageMagick - Memory Leak in TXT File Processing via Texture Attribute
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT fi…
-
Low 3.7
ImageMagick - Memory Leak in Raw Pixel Data Coders
ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and…
-
Low 3.7
ImageMagick - Heap Out-of-Bounds Read in PCD Decoder
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potentia…
-
Low 3.3
ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-56368.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-56370.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-56371.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-56378.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-56379.html