{"schemaVersion":3,"id":"SUSE-SU-2026:0852-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for ImageMagick\n\nThis update for ImageMagick fixes the following issues:\n\n- CVE-2026-24481: Possible Heap Information Disclosure in PSD ZIP Decompression (bsc#1258743).\n- CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).\n- CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).\n- CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).\n- CVE-2026-25637: Denial of Service via crafted image due to memory leak (bsc#1258759).\n- CVE-2026-25638: Denial of Service due to memory leak in image processing (bsc#1258793).\n- CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure\n  (bsc#1258792).\n- CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths\n  (bsc#1258757).\n- CVE-2026-25797: Code injection in various encoders (bsc#1258770).\n- CVE-2026-25798: NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (bsc#1258787).\n- CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).\n- CVE-2026-25897: Out-of-bounds heap write via integer overflow in sun decoder (bsc#1258799).\n- CVE-2026-25898: Information disclosure or denial of service via crafted image with invalid pixel index (bsc#1258807).\n- CVE-2026-25965: Policy bypass through path traversal allows reading restricted content despite secured policy\n  (bsc#1258785).\n- CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access\n  (bsc#1258780).\n- CVE-2026-25967: Stack buffer overflow in FTXT reader via oversized integer field (bsc#1258779).\n- CVE-2026-25968: MSL attribute stack buffer overflow leads to out of bounds write (bsc#1258776).\n- CVE-2026-25969: Memory Leak in coders/ashlar.c (bsc#1258775).\n- CVE-2026-25970: Memory corruption and denial of service via signed integer overflow in SIXEL decoder (bsc#1258802).\n- CVE-2026-25971: MSL: Stack overflow in ProcessMSLScript (bsc#1258774).\n- CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).\n- CVE-2026-25985: Memory allocation with excessive without limits in the internal SVG decoder (bsc#1258812).\n- CVE-2026-25986: Denial of Service via malicious YUV image processing (bsc#1258818).\n- CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).\n- CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).\n- CVE-2026-25989: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG\n  decoder (bsc#1258771).\n- CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).\n- CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).\n- CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).\n- CVE-2026-27798: Heap Buffer Over-read in WaveletDenoise when processing small images (bsc#1259018).\n- CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).","dates":{"published":"2026-03-09T15:32:56.000Z","modified":"2026-03-10T12:45:06.531Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"ImageMagick&distro=openSUSE Leap 15.6","name":"ImageMagick","label":"ImageMagick&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/ImageMagick&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 7.1.1.21-150600.3.42.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.1.1.21-150600.3.42.2","eol":null,"hubHref":null},{"vendor":"suse","product":"ImageMagick&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","name":"ImageMagick","label":"ImageMagick&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ImageMagick&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","purlType":"rpm","versions":[{"text":"< 7.1.1.21-150600.3.42.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.1.1.21-150600.3.42.2","eol":null,"hubHref":null},{"vendor":"suse","product":"ImageMagick&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","name":"ImageMagick","label":"ImageMagick&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ImageMagick&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 7.1.1.21-150600.3.42.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.1.1.21-150600.3.42.2","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260852-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20260852-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1258743","label":"bugzilla.suse.com/1258743","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258748","label":"bugzilla.suse.com/1258748","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258757","label":"bugzilla.suse.com/1258757","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258759","label":"bugzilla.suse.com/1258759","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258763","label":"bugzilla.suse.com/1258763","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258765","label":"bugzilla.suse.com/1258765","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258769","label":"bugzilla.suse.com/1258769","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258770","label":"bugzilla.suse.com/1258770","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258771","label":"bugzilla.suse.com/1258771","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258774","label":"bugzilla.suse.com/1258774","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258775","label":"bugzilla.suse.com/1258775","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258776","label":"bugzilla.suse.com/1258776","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258779","label":"bugzilla.suse.com/1258779","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258780","label":"bugzilla.suse.com/1258780","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258785","label":"bugzilla.suse.com/1258785","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258786","label":"bugzilla.suse.com/1258786","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258787","label":"bugzilla.suse.com/1258787","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258790","label":"bugzilla.suse.com/1258790","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258791","label":"bugzilla.suse.com/1258791","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258792","label":"bugzilla.suse.com/1258792","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258793","label":"bugzilla.suse.com/1258793","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258799","label":"bugzilla.suse.com/1258799","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258802","label":"bugzilla.suse.com/1258802","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258805","label":"bugzilla.suse.com/1258805","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258807","label":"bugzilla.suse.com/1258807","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258810","label":"bugzilla.suse.com/1258810","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258812","label":"bugzilla.suse.com/1258812","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258818","label":"bugzilla.suse.com/1258818","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258821","label":"bugzilla.suse.com/1258821","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1259017","label":"bugzilla.suse.com/1259017","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1259018","label":"bugzilla.suse.com/1259018","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24481","label":"www.suse.com/security/cve/CVE-2026-24481","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24484","label":"www.suse.com/security/cve/CVE-2026-24484","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24485","label":"www.suse.com/security/cve/CVE-2026-24485","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25576","label":"www.suse.com/security/cve/CVE-2026-25576","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25637","label":"www.suse.com/security/cve/CVE-2026-25637","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25638","label":"www.suse.com/security/cve/CVE-2026-25638","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25795","label":"www.suse.com/security/cve/CVE-2026-25795","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25796","label":"www.suse.com/security/cve/CVE-2026-25796","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25797","label":"www.suse.com/security/cve/CVE-2026-25797","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25798","label":"www.suse.com/security/cve/CVE-2026-25798","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25799","label":"www.suse.com/security/cve/CVE-2026-25799","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25897","label":"www.suse.com/security/cve/CVE-2026-25897","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25898","label":"www.suse.com/security/cve/CVE-2026-25898","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25965","label":"www.suse.com/security/cve/CVE-2026-25965","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25966","label":"www.suse.com/security/cve/CVE-2026-25966","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25967","label":"www.suse.com/security/cve/CVE-2026-25967","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25968","label":"www.suse.com/security/cve/CVE-2026-25968","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25969","label":"www.suse.com/security/cve/CVE-2026-25969","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25970","label":"www.suse.com/security/cve/CVE-2026-25970","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25971","label":"www.suse.com/security/cve/CVE-2026-25971","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25983","label":"www.suse.com/security/cve/CVE-2026-25983","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25985","label":"www.suse.com/security/cve/CVE-2026-25985","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25986","label":"www.suse.com/security/cve/CVE-2026-25986","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25987","label":"www.suse.com/security/cve/CVE-2026-25987","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25988","label":"www.suse.com/security/cve/CVE-2026-25988","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25989","label":"www.suse.com/security/cve/CVE-2026-25989","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26066","label":"www.suse.com/security/cve/CVE-2026-26066","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26284","label":"www.suse.com/security/cve/CVE-2026-26284","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26983","label":"www.suse.com/security/cve/CVE-2026-26983","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27798","label":"www.suse.com/security/cve/CVE-2026-27798","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27799","label":"www.suse.com/security/cve/CVE-2026-27799","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-24481","CVE-2026-24484","CVE-2026-24485","CVE-2026-25576","CVE-2026-25637","CVE-2026-25638","CVE-2026-25795","CVE-2026-25796","CVE-2026-25797","CVE-2026-25798","CVE-2026-25799","CVE-2026-25897","CVE-2026-25898","CVE-2026-25965","CVE-2026-25966","CVE-2026-25967","CVE-2026-25968","CVE-2026-25969","CVE-2026-25970","CVE-2026-25971","CVE-2026-25983","CVE-2026-25985","CVE-2026-25986","CVE-2026-25987","CVE-2026-25988","CVE-2026-25989","CVE-2026-26066","CVE-2026-26284","CVE-2026-26983","CVE-2026-27798","CVE-2026-27799"],"downstream":[],"duplicates":[],"related":["CVE-2026-24481","CVE-2026-24484","CVE-2026-24485","CVE-2026-25576","CVE-2026-25637","CVE-2026-25638","CVE-2026-25795","CVE-2026-25796","CVE-2026-25797","CVE-2026-25798","CVE-2026-25799","CVE-2026-25897","CVE-2026-25898","CVE-2026-25965","CVE-2026-25966","CVE-2026-25967","CVE-2026-25968","CVE-2026-25969","CVE-2026-25970","CVE-2026-25971","CVE-2026-25983","CVE-2026-25985","CVE-2026-25986","CVE-2026-25987","CVE-2026-25988","CVE-2026-25989","CVE-2026-26066","CVE-2026-26284","CVE-2026-26983","CVE-2026-27798","CVE-2026-27799"]},"timeline":[{"kind":"published","date":"2026-03-09T15:32:56.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-03-10T12:45:06.531Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T10:33:32.563Z","stale":false,"partial":false}}