Skip to content
OpenAdvisories
High ALAS2023-2026-1861 8 CVEs

Important: ImageMagick security update (Amazon Linux 2023)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53463: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when passing incorrect arguments in the distort operation a null pointer deference will occur. This issue has been patched in versions 6.9.13-50 and 7.1.2-25. CVE-2026-53461: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25. CVE-2026-53460: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25. CVE-2026-49219: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink. This issue has been patched in versions 6.9.13-48 and 7.1.2-24. CVE-2026-49218: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24. CVE-2026-48994: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24. CVE-2026-48734: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. This issue has been patched in versions 6.9.13-49 and 7.1.2-24. CVE-2026-48733: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in the subimage-search operation can happen when using a crafted image. This issue has been patched in versions 6.9.13-49 and 7.1.2-24.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2023 ImageMagick 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-c++ 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-c++-debuginfo 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-c++-devel 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-debuginfo 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-debugsource 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-devel 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-doc 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-libs 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-libs-debuginfo 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-perl 1:6.9.13.50-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-perl-debuginfo 1:6.9.13.50-1.amzn2023.0.1

Vulnerabilities 8

  • High 7.5
    CVE-2026-49218

    ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 7.5
    CVE-2026-53460

    ImageMagick: Policy Bypass can trigger out-of-Memory condition

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue ha…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 7.5
    CVE-2026-53461

    ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.9
    CVE-2026-48994

    ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-48734

    ImageMagick: Stack Overflow in MVG decoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. This issue has been patch…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.5
    CVE-2026-49219

    ImageMagick: Policy Bypass can read disallowed files

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 4.7
    CVE-2026-48733

    ImageMagick: Infinite Loop in subimage-search with crafted image

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in the subimage-search operation can happen when using a crafted image. This issue has been patched in ve…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 4.3
    CVE-2026-53463

    ImageMagick: Null Pointer Dereference in distort operation when passing incorrect arguments

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when passing incorrect arguments in the distort operation a null pointer deference will occur. This issue has been patched…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48733.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48734.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48994.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-49218.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-49219.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53460.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53461.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53463.html