Skip to content
OpenAdvisories
High ALAS2-2026-4061 1 CVE

Important: ImageMagick security update (Amazon Linux 2)

Published Nov 2, 2026 · Updated Nov 2, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-116149: A flaw was found in ImageMagick. A stack-based buffer overflow vulnerability exists in the handling of bzip2 compressed images, where stack memory can be overwritten during decoding. By submitting a specially crafted image, an attacker can exploit this issue to cause memory corruption or crash the application, resulting in a Denial of Service (DoS).

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 ImageMagick 0:6.9.10.97-1.amzn2.0.33
Amazon Linux · 2 ImageMagick-c++ 0:6.9.10.97-1.amzn2.0.33
Amazon Linux · 2 ImageMagick-c++-devel 0:6.9.10.97-1.amzn2.0.33
Amazon Linux · 2 ImageMagick-debuginfo 0:6.9.10.97-1.amzn2.0.33
Amazon Linux · 2 ImageMagick-devel 0:6.9.10.97-1.amzn2.0.33
Amazon Linux · 2 ImageMagick-doc 0:6.9.10.97-1.amzn2.0.33
Amazon Linux · 2 ImageMagick-perl 0:6.9.10.97-1.amzn2.0.33

Vulnerabilities 1

  • High 8.1
    CVE-2026-116149

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-116149.html