SUSE-SU-2026:0854-1: ImageMagick&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:0854-1 is a vulnerability in ImageMagick&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 09-03-2026
   PublishedVulnerability first disclosed.
2. 10-03-2026
   Last modifiedVulnerability information updated.

Description

Security update for ImageMagick This update for ImageMagick fixes the following issues: - CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790). - CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791). - CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748). - CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure (bsc#1258792). - CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (bsc#1258757). - CVE-2026-25797: Code injection in various encoders (bsc#1258770). - CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786). - CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access (bsc#1258780). - CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805). - CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821). - CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810). - CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769). - CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765). - CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763). - CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).

No weakness data has been published for this record.