Skip to content
OpenAdvisories
High RHSA-2026:32961 9 CVEs

Red Hat Security Advisory: ImageMagick security update

Published Jun 30, 2026 · Updated Aug 18, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · RHEL 7 ELS rhel_els:7 ImageMagick 0:6.9.10.68-17.el7_9
Red Hat · RHEL 7 ELS rhel_els:7 ImageMagick-c++ 0:6.9.10.68-17.el7_9
Red Hat · RHEL 7 ELS rhel_els:7 ImageMagick-c++-devel 0:6.9.10.68-17.el7_9
Red Hat · RHEL 7 ELS rhel_els:7 ImageMagick-debuginfo 0:6.9.10.68-17.el7_9
Red Hat · RHEL 7 ELS rhel_els:7 ImageMagick-devel 0:6.9.10.68-17.el7_9
Red Hat · RHEL 7 ELS rhel_els:7 ImageMagick-doc 0:6.9.10.68-17.el7_9
Red Hat · RHEL 7 ELS rhel_els:7 ImageMagick-perl 0:6.9.10.68-17.el7_9

Vulnerabilities 9

  • High 8.1
    CVE-2026-56379

    ImageMagick - Command Injection via SVG Decoder

    ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu NuGet
  • High 7.5
    CVE-2026-46520

    ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 7.5
    CVE-2026-46522 Public exploit

    ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versi…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 7.5
    CVE-2026-49218

    ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other …

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • High 7.5
    CVE-2026-53460

    ImageMagick: Policy Bypass can trigger out-of-Memory condition

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue ha…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 6.2
    CVE-2026-46523

    ImageMagick: Use-After-Free in MSL decoder.

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-45031

    ImageMagick: Policy Bypass in PSD decoder

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a P…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 5.3
    CVE-2026-45664

    ImageMagick: Policy Bypass in MNG coder could

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allo…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet
  • Medium 4.1
    CVE-2026-46692

    ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu Alpine NuGet

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487729
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487730
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487732
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487734
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487743
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487749
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487757
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487763
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2491700
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_32961.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-45031
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45031
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45031
  • article
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx
  • report
    https://access.redhat.com/security/cve/CVE-2026-45664
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45664
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45664
  • article
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6
  • report
    https://access.redhat.com/security/cve/CVE-2026-46520
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46520
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46520
  • article
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5
  • report
    https://access.redhat.com/security/cve/CVE-2026-46522
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46522
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46522
  • article
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5
  • report
    https://access.redhat.com/security/cve/CVE-2026-46523
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46523
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46523
  • article
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q
  • report
    https://access.redhat.com/security/cve/CVE-2026-46692
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46692
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46692
  • article
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p93h-f2jc-477j
  • report
    https://access.redhat.com/security/cve/CVE-2026-49218
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49218
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49218
  • article
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc