Summary
It was discovered that ImageMagick did not correctly handle certain images.
An attacker could possibly use this issue to cause a denial of service or
obtain sensitive information. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
(CVE-2026-56367)
It was discovered that ImageMagick did not correctly handle certain images.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2026-93586)
It was discovered that ImageMagick did not correctly handle certain images.
A local attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-93587, CVE-2026-93588)
It was discovered that ImageMagick did not correctly handle certain images.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-93589)
It was discovered that ImageMagick did not correctly handle certain images.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 26.04 LTS. (CVE-2026-93590)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | imagemagick | 8:6.7.7.10-6ubuntu3.13+esm27 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | imagemagick | 8:6.8.9.9-7ubuntu5.16+esm26 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | imagemagick | 8:6.9.7.4+dfsg-16ubuntu6.15+esm18 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | imagemagick | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | imagemagick | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | imagemagick | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | imagemagick | 8:7.1.2.18+dfsg1-1ubuntu0.1~esm4 |
Vulnerabilities 6
-
Low 3.7
ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to inf…
-
Low 3.7
ImageMagick before 7.1.2-31 Division by Zero in FLIF encoder
ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is …
-
Low 3.7
ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potential…
-
Low 3.3
ImageMagick before 7.1.2-31 Policy Bypass via PCD decoder
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can resu…
-
Low 3.1
ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferen…
-
Low 2.9
ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected pro…