DEBIAN-CVE-2026-56361

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-56361
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56361.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-56361
Upstream
Published
2026-06-30T23:17:31Z
Modified
2026-09-14T17:03:45Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVSS Calculator
Summary
[none]
Details

ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations.

References

Affected packages

Debian:12 / imagemagick

Package

Name
imagemagick
Purl
pkg:deb/debian/imagemagick?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8:6.9.11.60+dfsg-1.6+deb12u12

Affected versions

8:6.*
8:6.9.11.60+dfsg-1.6
8:6.9.11.60+dfsg-1.6+deb12u1
8:6.9.11.60+dfsg-1.6+deb12u2
8:6.9.11.60+dfsg-1.6+deb12u3
8:6.9.11.60+dfsg-1.6+deb12u4
8:6.9.11.60+dfsg-1.6+deb12u5
8:6.9.11.60+dfsg-1.6+deb12u6
8:6.9.11.60+dfsg-1.6+deb12u7
8:6.9.11.60+dfsg-1.6+deb12u8
8:6.9.11.60+dfsg-1.6+deb12u9
8:6.9.11.60+dfsg-1.6+deb12u10
8:6.9.11.60+dfsg-1.6+deb12u11

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56361.json"

Debian:13 / imagemagick

Package

Name
imagemagick
Purl
pkg:deb/debian/imagemagick?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8:7.1.1.43+dfsg1-1+deb13u11

Affected versions

8:7.*
8:7.1.1.43+dfsg1-1
8:7.1.1.43+dfsg1-1+deb13u1
8:7.1.1.43+dfsg1-1+deb13u2
8:7.1.1.43+dfsg1-1+deb13u3
8:7.1.1.43+dfsg1-1+deb13u4
8:7.1.1.43+dfsg1-1+deb13u5
8:7.1.1.43+dfsg1-1+deb13u6
8:7.1.1.43+dfsg1-1+deb13u7
8:7.1.1.43+dfsg1-1+deb13u8
8:7.1.1.43+dfsg1-1+deb13u9
8:7.1.1.43+dfsg1-1+deb13u10

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56361.json"

Debian:14 / imagemagick

Package

Name
imagemagick
Purl
pkg:deb/debian/imagemagick?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8:7.1.2.19+dfsg1-1

Affected versions

8:7.*
8:7.1.1.43+dfsg1-1
8:7.1.1.46+dfsg1-1
8:7.1.1.47+dfsg1-1
8:7.1.1.47+dfsg1-2
8:7.1.2.1+dfsg1-1
8:7.1.2.3+dfsg1-1
8:7.1.2.7+dfsg1-1
8:7.1.2.8+dfsg1-1
8:7.1.2.12+dfsg1-1
8:7.1.2.13+dfsg1-1
8:7.1.2.15+dfsg1-1
8:7.1.2.15+dfsg1-2
8:7.1.2.16+dfsg1-1
8:7.1.2.18+dfsg1-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56361.json"