Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-56370: ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution. CVE-2026-40311: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19. CVE-2026-40310: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below both 7.1.2-19 and 6.9.13-44, contain a heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling index. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19. CVE-2026-40169: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image could result in an out of bounds heap write when writing a yaml or json output, resulting in a crash. This issue has been fixed in version 7.1.2-19. CVE-2026-33908: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19. CVE-2026-33905: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample operation has an out of bounds read when an specific offset is set through the `sample:offset` define that could lead to an out of bounds read. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19. CVE-2026-33899: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | ImageMagick | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-c++ | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-c++-debuginfo | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-c++-devel | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-debuginfo | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-debugsource | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-devel | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-doc | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-libs | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-libs-debuginfo | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-perl | 1:6.9.13.44-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-perl-debuginfo | 1:6.9.13.44-1.amzn2023.0.1 |
Vulnerabilities 7
-
High 7.5
ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recurs…
-
Medium 6.2
ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encoders
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image could result in an out of bounds heap write when writing a yaml or json output, resulting in a crash. This issue has bee…
-
Medium 5.5
ImageMagick has an Out-of-Bounds read via -sample operation
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample operation has an out of bounds read when an specific offset is set through the `sample:offset` define tha…
-
Medium 5.5
ImageMagick: Heap out-of-bounds write in JP2 encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below both 7.1.2-19 and 6.9.13-44, contain a heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling index. This issue h…
-
Medium 5.5
ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing values
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profil…
-
Medium 5.3
ImageMagick: Heap BufferOverflow write of single zero byte when parsing XML
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been…
-
Low 3.3
ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33899.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33905.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33908.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-40169.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-40310.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-40311.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-56370.html