CLSA-2026-1783415795
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1783415795.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1783415795
- Upstream
- Published
- 2026-07-07T09:17:09Z
- Modified
- 2026-10-26T09:31:58Z
- Summary
- ImageMagick: Fix of 12 CVEs
- Details
-
- CVE-2026-33901: fix heap buffer overflow (out-of-bounds write) in the MVG decoder when copying an over-long token into a fixed-size buffer
- CVE-2026-33908: fix stack exhaustion denial of service in DestroyXMLTree() by imposing a recursion depth limit on deeply nested XML
- CVE-2026-45031: fix list-length resource policy bypass in the PSD decoder by validating the layer count against the list limit
- CVE-2026-45664: fix excessive resource use in the MNG coder by bounding the number of LOOP/ENDL operations
- CVE-2026-46520: fix heap out-of-bounds write in the IPL coder when writing multiple images with differing dimensions
- CVE-2026-46522: fix infinite loop (CPU exhaustion) in the MIFF decoder on a crafted file
- CVE-2026-46523: fix heap use-after-free in the MSL coder by disabling blob support for the MSL format
- References
-
- https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1783415795.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-33901
- https://nvd.nist.gov/vuln/detail/CVE-2026-33908
- https://nvd.nist.gov/vuln/detail/CVE-2026-42326
- https://nvd.nist.gov/vuln/detail/CVE-2026-45031
- https://nvd.nist.gov/vuln/detail/CVE-2026-45624
- https://nvd.nist.gov/vuln/detail/CVE-2026-45664
- https://nvd.nist.gov/vuln/detail/CVE-2026-46520
- https://nvd.nist.gov/vuln/detail/CVE-2026-46521
- https://nvd.nist.gov/vuln/detail/CVE-2026-46522
- https://nvd.nist.gov/vuln/detail/CVE-2026-46523
- https://nvd.nist.gov/vuln/detail/CVE-2026-48734
- https://nvd.nist.gov/vuln/detail/CVE-2026-48994