OESA-2026-4017

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4017
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-4017
Upstream
CVE (4)
Published
2026-09-25T01:27:20Z
Modified
2026-09-25T01:45:04Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
ImageMagick security update
Details

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions 7.1.2-31 and 6.9.13-56.(CVE-2026-93586)

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56.(CVE-2026-93587)

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image.(CVE-2026-93588)

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56.(CVE-2026-93589)

Database specific 
{
    "severity":  "Low"
}
References

Affected packages

openEuler:20.03-LTS-SP4
ImageMagick

Package

Name
ImageMagick
Purl
pkg:rpm/openEuler/ImageMagick&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.9.13.56-1.oe2003sp4

Ecosystem specific 

{
    "aarch64":  [
        "ImageMagick-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-c++-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-c++-devel-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-debuginfo-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-debugsource-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-devel-6.9.13.56-1.oe2003sp4.aarch64.rpm",
        "ImageMagick-perl-6.9.13.56-1.oe2003sp4.aarch64.rpm"
    ],
    "noarch":  [
        "ImageMagick-help-6.9.13.56-1.oe2003sp4.noarch.rpm"
    ],
    "src":  [
        "ImageMagick-6.9.13.56-1.oe2003sp4.src.rpm"
    ],
    "x86_64":  [
        "ImageMagick-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-c++-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-c++-devel-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-debuginfo-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-debugsource-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-devel-6.9.13.56-1.oe2003sp4.x86_64.rpm",
        "ImageMagick-perl-6.9.13.56-1.oe2003sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"
openEuler:22.03-LTS-SP4
ImageMagick

Package

Name
ImageMagick
Purl
pkg:rpm/openEuler/ImageMagick&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.1.2.31-1.oe2203sp4

Ecosystem specific 

{
    "aarch64":  [
        "ImageMagick-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2203sp4.aarch64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2203sp4.aarch64.rpm"
    ],
    "noarch":  [
        "ImageMagick-help-7.1.2.31-1.oe2203sp4.noarch.rpm"
    ],
    "src":  [
        "ImageMagick-7.1.2.31-1.oe2203sp4.src.rpm"
    ],
    "x86_64":  [
        "ImageMagick-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2203sp4.x86_64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2203sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"
openEuler:24.03-LTS-SP1
ImageMagick

Package

Name
ImageMagick
Purl
pkg:rpm/openEuler/ImageMagick&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.1.2.31-1.oe2403sp1

Ecosystem specific 

{
    "aarch64":  [
        "ImageMagick-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp1.aarch64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp1.aarch64.rpm"
    ],
    "noarch":  [
        "ImageMagick-help-7.1.2.31-1.oe2403sp1.noarch.rpm"
    ],
    "src":  [
        "ImageMagick-7.1.2.31-1.oe2403sp1.src.rpm"
    ],
    "x86_64":  [
        "ImageMagick-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp1.x86_64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"
openEuler:24.03-LTS-SP3
ImageMagick

Package

Name
ImageMagick
Purl
pkg:rpm/openEuler/ImageMagick&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.1.2.31-1.oe2403sp3

Ecosystem specific 

{
    "aarch64":  [
        "ImageMagick-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp3.aarch64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp3.aarch64.rpm"
    ],
    "noarch":  [
        "ImageMagick-help-7.1.2.31-1.oe2403sp3.noarch.rpm"
    ],
    "src":  [
        "ImageMagick-7.1.2.31-1.oe2403sp3.src.rpm"
    ],
    "x86_64":  [
        "ImageMagick-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp3.x86_64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"
openEuler:24.03-LTS-SP4
ImageMagick

Package

Name
ImageMagick
Purl
pkg:rpm/openEuler/ImageMagick&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.1.2.31-1.oe2403sp4

Ecosystem specific 

{
    "aarch64":  [
        "ImageMagick-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp4.aarch64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp4.aarch64.rpm"
    ],
    "noarch":  [
        "ImageMagick-help-7.1.2.31-1.oe2403sp4.noarch.rpm"
    ],
    "src":  [
        "ImageMagick-7.1.2.31-1.oe2403sp4.src.rpm"
    ],
    "x86_64":  [
        "ImageMagick-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-c++-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-c++-devel-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-debuginfo-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-debugsource-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-devel-7.1.2.31-1.oe2403sp4.x86_64.rpm",
        "ImageMagick-perl-7.1.2.31-1.oe2403sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4017.json"