We believe that the bug you reported is fixed in the latest version of
imagemagick, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1150224@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bastien Roucariès <rouca@debian.org> (supplier of updated imagemagick package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 23 Oct 2026 21:46:42 +0200
Source: imagemagick
Architecture: source
Version: 8:7.1.1.43+dfsg1-1+deb13u13
Distribution: trixie-security
Urgency: medium
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Closes: 1147176 1149974 1150224 1150337
Changes:
imagemagick (8:7.1.1.43+dfsg1-1+deb13u13) trixie-security; urgency=medium
.
* Security fixes (Closes: #1147176, #1149974, #1150337)
* Fix regression of CVE-2026-25971:
SVG <image> with data: URI fails ("unable to open image")
(Closes: #1150224)
* Port distribute cache to 7.1.2.33
* Port coders/mat.c to 7.1.2.33
* Fix CVE-2026-62343:
An invalid kernel can cause a heap buffer over-write
when performing a morphology operation with a user supplied kernel.
* Fix CVE-2026-62946:
Processing an extremely large JNX file on 32-bit platforms
can cause an integer overflow, leading to a heap buffer over-write.
* Fix CVE-2026-62363:
A heap buffer over-write can occur in the fx operation by
passing a crafted argument.
* Fix CVE-2026-64685:
The BGR decoder does not check for an end-of-file in every location
so a crafted image could result in an heap buffer over-read.
* Fix CVE-2026-86420:
Imagemagick fails to properly lower the memory budget when
an operation inside OpenPixelCache fails. Repeated triggering
of such failures can exhaust the process memory budget and
result in a denial of service.
* Fix CVE-2026-86421
Fix a memory leak in the MSL image decoder.
A crafted MSL image triggers memory allocation
without proper deallocation, allowing an attacker to
exhaust memory and cause a denial of service.
* Fix CVE-2026-86423:
a heap-use-after-free vulnerability in the GetList method
of PerlMagick. A crafted call to the GetList method can
trigger the use-after-free, resulting in a crash
(denial of service).
* Fix CVE-2026-86424:
A time-of-check-time-of-use (TOCTOU) vulnerability in the video
decoder that allows attackers to bypass path policy write
restrictions via symlink swaps
* Fix CVE-2026-86425:
A heap-use-after-free vulnerability in the Layer method of PerlMagick.
* Fix CVE-2026-93586:
A use-after-free vulnerability in the ImagesToBlob method, caused by a
pointer that is not updated correctly. Exploitation may result in
a limited availability impact (e.g., a crash of the affected process).
* Fix CVE-2026-93587:
A policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD)
coder: when a specific command line option is supplied, the decoder
does not check a configured resource limit, which can result
in extra memory allocation.
* Fix CVE-2026-93588:
a NULL pointer dereference in the PNM coder. When the coder reaches
a memory (resource) limit at a specific point during processing,
the failed allocation is not handled and a NULL pointer is dereferenced,
which can lead to a denial of service (application crash) when
processing a specially crafted or sufficiently large PNM image.
* Fix CVE-2026-93589:
A division-by-zero flaw in the FLIF encoder. An incorrect value for
ticks per second in the image being encoded causes a divide-by-zero
and crashes the encoder, resulting in a denial of service.
* Fix CVE-2026-93590:
a policy bypass vulnerability in the UHDR encoder that fails
to perform policy checks during buffer allocation for image pixels.
Attackers can bypass resource policies by processing specially crafted
UHDR images, potentially causing denial of service through
excessive memory allocation.
* Fix CVE-2026-102635:
imagemagick contain uninitialized heap memory disclosure in the GIF
decoder's application extension handler in coders/gif.c.
Attackers can craft malicious GIF files that cause the number
parser to read uninitialized heap memory and store contents
as image metadata, disclosing sensitive heap information.
* Fix CVE-2026-106564:
A crafted EXR image can cause the EXR decoder to write beyond a
heap buffer, causing the process to crash.
* Fix CVE-2026-106565:
A missing end-of-file check while reading bzip2-compressed
image data can cause an infinite loop and exhaust processing resources.
* Fix CVE-2026-106566:
Delegate symlink cleanup does not check the MAGICK_SHRED_PASSES
environment variable, allowing a local privileged workflow to
overwrite a file with random data.
* Fix CVE-2026-106567:
A crafted PSD file can trigger an integer-conversion error
in the PSD decoder on 32-bit builds, causing an infinite
loop and denial of service.
* Fix CVE-2026-106568:
A crafted XMP profile embedded in an image can cause
the profile parser to enter an infinite loop, preventing image
processing from completing.
* Fix CVE-2026-106570:
An unauthenticated adjacent-network client can repeatedly connect
to the distributed pixel cache server and exhaust its available
connections, causing denial of service.
* Fix CVE-2026-106571:
A crafted local call to the GetVirtualPixels API can trigger
an integer calculation error and write beyond a heap buffer,
crashing the server process.
* Fix CVE-2026-106572:
A missing recursion-depth check in the CALS decoder
allows a crafted CALS image to exhaust the call stack
and terminate the process.
* Fix CVE-2026-106573:
a missing limit check in the MVG decoder allows a crafted MVG
image to trigger an excessively long-running operation.
* Fix CVE-2026-106574:
A client connected to the distributed pixel cache server
can send crafted pixel data that triggers an integer-size
calculation error and a heap buffer overwrite, crashing the server.
* Fix CVE-2026-106575:
A crafted Magick script can cause an opened file pointer
to remain unclosed, allowing repeated processing to exhaust
available file descriptors
* Fix CVE-2026-106576:
A crafted XMP profile can trigger excessive work while the
parser determines a rational value's numerator and denominator,
causing denial of service
* Fix CVE-2026-106577:
Unescaped or untrimmed values can inject code into output
generated by PostScript coders.
* Fix CVE-2026-106578:
A crafted image can cause an invalid memory free in the
MVG decoder and crash the process
* Fix CVE-2026-106579:
a crafted image can bypass an ImageMagick security policy that
uses coder as its domain, potentially allowing data prohibited
by the policy to be read.
* Fix CVE-2026-106580:
a missing security-policy check in the CUT encoder allows a
crafted local encoding operation to read data that policy should
deny and can also cause a crash.
* Fix CVE-2026-107208:
Denial of service with crafted XMP profile
* Fix CVE-2026-107209:
when ImageMagick is built without Cairo support, a crafted
RSVG image that reaches a resource limit can cause the
RSVG decoder to free image state twice and then use freed memory,
crashing the process
* Fix CVE-2026-107210:
A crafted highly compressed MAT image can make the MAT decoder
create temporary files larger than the configured security-policy
limit, bypassing resource restrictions and consuming excessive
disk space.
* Fix CVE-2026-109261:
imagemagick contains a memory leak in the GIF encoder
because allocated memory is not released when color quantization
fails during encoding. Attackers can supply images whose
GIF conversion causes quantization to fail, leaking memory
with each attempt and degrading availability.
* Fix GHSA-83w9-w85j-h9jc:
Memory Leak in MAT decoder in an error path.
Checksums-Sha1:
42f447bb6abea3feb7b3f3312b7901a065244508 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u13.dsc
103af0af388a733c043845b228cf3031c16d859b 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz
5b772a7cfd13900061961d0760acd1e2760e26ae 403292 imagemagick_7.1.1.43+dfsg1-1+deb13u13.debian.tar.xz
88778a357561066add669f35cc70de5f4dadb8b9 8958 imagemagick_7.1.1.43+dfsg1-1+deb13u13_source.buildinfo
Checksums-Sha256:
bbd83d09b7e11a0c13b0334bb6703abf86359243d5283a0b0edbbe47e187ebca 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u13.dsc
bcb4f3c78a930a608fa4889f889edbcb384974246ad9407fce1858f2c0607bfe 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz
4a1dfe533644f2c567ba474af9e78fca20e6d84535aafce42fe1ff6a03d593db 403292 imagemagick_7.1.1.43+dfsg1-1+deb13u13.debian.tar.xz
d08373fb5f0cce5198a5605a775c6ba2850348ff02c9f5e51b8c0048d908d523 8958 imagemagick_7.1.1.43+dfsg1-1+deb13u13_source.buildinfo
Files:
1d310e55237548a9fd047c04754cba1e 5165 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u13.dsc
01cfb13a7c1813afb50790e431358c6c 10501740 graphics optional imagemagick_7.1.1.43+dfsg1.orig.tar.xz
76399ec6da40722298e3c5b47ce56e28 403292 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u13.debian.tar.xz
9fe0e7c6614b9db333e1026ffecf38f0 8958 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u13_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmriACoACgkQADoaLapB
CF/OfA//VykQokzOxS7QGif+UsNr40JvF8JhnMRseIySmFGw8UMtfn6URM5e0F2T
ZcJvEOxnm3f17lCAR8BQjrEo0r/O7C0tr80BQiSx4Ex5kd9Xp4FvXr6QENMXJbKM
jkaieLvAFIXpaHtluQr1Yn1aTTHuE5vjFVjuv+qRvCl0QUj9QBc/5B4kd9+m4s4J
Ud3cKeWBACozLYmzahcCqBa9vIV+1WeVlNQGOx56knEn8Rp8YmT6dgKvv9/WbavM
fbESOkkYNYcK9HkwdQRHI0GB/Y1pU5JIpWDDjwpuP/GNhX+gztvHAcbmffumQjCh
GSU5lYQN8PM1ctZdBe6DG3dbx93oabT7D1FfjBKiTPUb8iszOZYQ+rfvdx7PDVW+
TGqUwSXT+/m21XsvhNI/vXFiuQe70KaDjqeC6QHOpZLOlFgEuPljbpR9fi2Y6Er9
p4y5RfdaQfwAsRTxP4vtU5Z/3Dmjo63NvafiSae6A/Pdv1XMKZSXbxalh0AY4xPD
HK68GbWASjvPzuqYF70eYgI6/Bzt8zrEOwh3vSx4vq4F789Cq3OH+B3dtkJdLD2y
L8b50QoMCZJL/WZQTo1MOjmFG8FlUhvu14LXzAXLvTAV8l9XXBWjcIhE9hp5KMvc
+OsEhba8kPxARZX0Hwn8XygaxiMy55CzOEpgN+hcLs74B+BLbfs=
=ix1H
-----END PGP SIGNATURE-----