Skip to content
OpenAdvisories
Low WID-SEC-2026-2967 6 CVEs

ImageMagick: Mehrere Schwachstellen

Published Aug 23, 2026 · Updated Oct 29, 2026 · Revision 9 · de-DE

Vendor: amazon Vendor: Debian Vendor: SUSE Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.

Product

ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann.

Vulnerabilities 6

  • Low 3.7
    CVE-2026-86420

    ImageMagick before 7.1.2-30 Denial of Service Memory Budget

    ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.7
    CVE-2026-86421

    ImageMagick before 7.1.2-30 Memory Leak via MSL decoder

    ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.3
    CVE-2026-86422

    ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race

    ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy v…

    ImageMagick ImageMagick imagemagick Ubuntu
  • Low 3.3
    CVE-2026-86423

    ImageMagick before 7.1.2-30 Heap-use-after-free via GetList

    ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 3.3
    CVE-2026-86425

    ImageMagick before 7.1.2-30 Heap-use-after-free via Layer

    ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu
  • Low 2.5
    CVE-2026-86424

    ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race

    ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy valid…

    ImageMagick ImageMagick imagemagick imagemagick Debian Ubuntu

Revision history

  1. #9

    Neue Updates von Debian aufgenommen

  2. #8

    Neue Updates von Debian aufgenommen

  3. #7

    Neue Updates von SUSE aufgenommen

  4. #6

    Neue Updates von SUSE aufgenommen

  5. #5

    Neue Updates von SUSE und Amazon aufgenommen

  6. #4

    Neue Updates von SUSE und openSUSE aufgenommen

  7. #3

    Neue Updates von SUSE aufgenommen

  8. #2

    Referenz(en) aufgenommen: CVE-2026-86423, EUVD-2026-72381, CVE-2026-86424, EUVD-2026-72382, CVE-2026-86421, EUVD-2026-72379, CVE-2026-86420, EUVD-2026-72378, CVE-2026-86422, EUVD-2026-72380, CVE-2026-86425, EUVD-2026-72383

  9. #1

    Initiale Fassung

References