Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32259: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, when a memory allocation fails in the sixel encoder it would be possible to write past the end of a buffer on the stack. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. CVE-2026-31853: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, an overflow on 32-bit systems can cause a crash in the SFW decoder when processing extremely large images. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. CVE-2026-30937: A flaw was found in ImageMagick, a software suite for editing and manipulating digital images. An integer overflow vulnerability exists in the XWD (X Windows) encoder when processing extremely large images. This flaw can lead to an undersized memory allocation, resulting in an out-of-bounds write to the heap. A local attacker could exploit this to cause a denial of service (DoS) or potentially impact data integrity. CVE-2026-30936: A flaw was found in ImageMagick, a free and open-source software for editing and manipulating digital images. A remote attacker could exploit this vulnerability by providing a specially crafted image to a user, which, when processed with the -wavelet-denoise operation, could lead to an out-of-bounds heap write. This issue can result in a denial of service (DoS), causing the application to become unstable or crash. CVE-2026-30929: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. CVE-2026-30883: A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A local attacker could exploit this vulnerability by providing an extremely large image profile when encoding a PNG image. This could result in a heap overflow, leading to a Denial of Service (DoS), which makes the affected system or application unavailable to legitimate users. CVE-2026-28693: A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. An integer overflow vulnerability in the DIB (Device Independent Bitmap) coder component can be exploited by a remote attacker. By processing a specially crafted image file, this flaw may lead to an out-of-bounds read or write, potentially resulting in arbitrary code execution, privilege escalation, information disclosure, or a Denial of Service (DoS). CVE-2026-28692: A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A remote attacker could exploit a heap over-read vulnerability in the MAT decoder due to incorrect parenthesization when using 32-bit arithmetic. This could lead to the disclosure of sensitive information and a denial of service (DoS) condition. CVE-2026-28691: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. CVE-2026-28690: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow vulnerability exists in the MNG encoder. There is a bounds checks missing that could corrupting the stack with attacker-controlled data. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. CVE-2026-28689: A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A time-of-check to time-of-use (TOCTOU) vulnerability exists where authorization for a file path is checked before the file is finally opened or used. A local attacker can exploit this by performing a symlink swap between the check-time and use-time, bypassing policy-denied read/write operations. This can lead to information disclosure and unauthorized modification of files. CVE-2026-28688: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. CVE-2026-28687: A flaw was found in ImageMagick, free and open-source software used for editing and manipulating digital images. A heap use-after-free vulnerability in ImageMagick's MSL (Magick Scripting Language) decoder allows an attacker to trigger access to freed memory by crafting a malicious MSL file. This can lead to a denial of service. CVE-2026-28686: A flaw was found in ImageMagick, free and open-source software used for editing and manipulating digital images. A local attacker could exploit a heap-buffer-overflow vulnerability in the PCL encode due to an undersized output buffer allocation. This could lead to a denial of service (DoS), making the software unavailable, and potentially impact data integrity. CVE-2026-28494: A flaw was found in ImageMagick. This vulnerability, a stack buffer overflow, allows an attacker to cause stack corruption by providing maliciously crafted kernel strings. This can lead to arbitrary code execution or a denial of service (DoS), impacting the availability and integrity of the system. CVE-2026-28493: A flaw was found in ImageMagick. An integer overflow vulnerability exists in the SIXEL decoder, which allows a remote attacker to perform an out-of-boun
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | ImageMagick | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-c++ | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-c++-debuginfo | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-c++-devel | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-debuginfo | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-debugsource | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-devel | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-doc | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-libs | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-libs-debuginfo | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-perl | 1:6.9.13.41-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-perl-debuginfo | 1:6.9.13.41-1.amzn2023.0.1 |
Vulnerabilities 16
-
High 8.1
ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.…
-
High 7.7
ImageMagick has a stack buffer overflow in MagnifyImage
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrup…
-
High 7.5
ImageMagick has an uninitialized pointer dereference in JBIG decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability i…
-
High 7.1
ImageMagick affected by stack corruption through long morphology kernel names or arrays
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceed…
-
Medium 6.9
ImageMagick has a stack write buffer overflow in MNG encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow vulnerability exists in the MNG encoder. There is a bounds checks missing that could corrupting th…
-
Medium 6.8
ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output buffer
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, A heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation. This vulnerab…
-
Medium 6.8
ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a 32-bit unsigned integer overflow in the XWD (X Windows) encoder can cause an undersized heap buffer allocation. When wri…
-
Medium 6.7
ImageMagick has a possible stack buffer overflow in sixel encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, when a memory allocation fails in the sixel encoder it would be possible to write past the end of a buffer on the stack. This vulne…
-
Medium 6.5
ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a spe…
-
Medium 6.3
ImageMagick has a Path Policy TOCTOU symlink race bypass
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses…
-
Medium 5.7
ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an extremely large image profile could result in a heap overflow when encoding a PNG image. This vulnerability is fixed in…
-
Medium 5.7
ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, an overflow on 32-bit systems can cause a crash in the SFW decoder when processing extremely large images. This vulnerability is fi…
-
Medium 5.5
ImageMagick has a heap Buffer Overflow in WaveletDenoiseImage
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a crafted image could cause an out of bounds heap write inside the WaveletDenoiseImage method. When processing a crafted i…
-
Medium 5.3
ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by c…
-
Medium 4.8
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read. This vulnerability is …
-
Medium 4.0
ImageMagick has a heap use-after-free in the MSL encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28493.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28494.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28686.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28687.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28688.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28689.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28690.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28691.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28692.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28693.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-30883.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-30929.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-30936.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-30937.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31853.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-32259.html