Skip to content
OpenAdvisories
Medium ALAS2023-2026-1914 1 CVE

Moderate: ImageMagick security update (Amazon Linux 2023)

Published Jul 6, 2026 · Updated Jul 7, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-56379: ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2023 ImageMagick 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-c++ 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-c++-debuginfo 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-c++-devel 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-debuginfo 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-debugsource 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-devel 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-doc 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-libs 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-libs-debuginfo 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-perl 1:6.9.13.50-1.amzn2023.0.2
Amazon Linux · 2023 ImageMagick-perl-debuginfo 1:6.9.13.50-1.amzn2023.0.2

Vulnerabilities 1

  • High 8.1
    CVE-2026-56379

    ImageMagick - Command Injection via SVG Decoder

    ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56379.html