CLSA-2026-1789467564
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.5els/CLSA-2026-1789467564.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789467564
- Upstream
- Published
- 2026-09-15T10:19:36Z
- Modified
- 2026-10-26T09:43:22Z
- Summary
- ImageMagick: Fix of 2 CVEs
- Details
-
- Rebase to EPEL 8 ImageMagick-6.9.13.52-2.el8, picking up the vendor's upstream soname-revert patch
- Drop the TuxCare backports for CVE-2026-61857, CVE-2026-61861, CVE-2026-61863, CVE-2026-61866 and CVE-2026-61870: all five are fixed in the 6.9.13.52 tarball, verified against the extracted source rather than the changelog
- Keep the CVE-2026-45664 backport: upstream dd198f960 landed in ImageMagick 7 and never reached the 6.x line, so both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer here
- Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
- CVE-2026-86420: relinquish the MemoryResource reservation when the in-memory pixel-cache allocation fails in OpenPixelCache (magick/cache.c)
- CVE-2026-86421: destroy the level's draw_info when MSLEndElement pops a group (coders/msl.c) to prevent a memory leak
- References