{"schemaVersion":3,"id":"SUSE-SU-2026:0854-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for ImageMagick\n\nThis update for ImageMagick fixes the following issues:\n\n- CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG to SVG conversion (bsc#1258790).\n- CVE-2026-24485: denial of service via malformed PCD file processing (bsc#1258791).\n- CVE-2026-25576: Out of bounds read in multiple coders that read raw pixel data (bsc#1258748).\n- CVE-2026-25795: Denial of Service due to NULL pointer dereference during temporary file creation failure\n  (bsc#1258792).\n- CVE-2026-25796: Memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths\n  (bsc#1258757).\n- CVE-2026-25797: Code injection in various encoders (bsc#1258770).\n- CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to crash (bsc#1258786).\n- CVE-2026-25966: Security Policy Bypass through config/policy-secure.xml via 'fd handler' leads to stdin/stdout access\n  (bsc#1258780).\n- CVE-2026-25983: Denial of service via crafted MSL script (bsc#1258805).\n- CVE-2026-25987: Memory disclosure and denial of service via crafted MAP files (bsc#1258821).\n- CVE-2026-25988: Denial of Service due to memory leak in image processing (bsc#1258810).\n- CVE-2026-26066: Infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (bsc#1258769).\n- CVE-2026-26284: Heap overflow in pcd decoder leads to out of bounds read (bsc#1258765).\n- CVE-2026-26983: Invalid MSL <map> can result in a use after free (bsc#1258763).\n- CVE-2026-27799: ImageMagick has a heap Buffer Over-read in its DJVU image format handler (bsc#1259017).","dates":{"published":"2026-03-09T15:34:51.000Z","modified":"2026-03-10T12:45:06.462Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"ImageMagick&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","name":"ImageMagick","label":"ImageMagick&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ImageMagick&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","purlType":"rpm","versions":[{"text":"< 6.8.8.1-71.231.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.8.8.1-71.231.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260854-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20260854-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1258748","label":"bugzilla.suse.com/1258748","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258757","label":"bugzilla.suse.com/1258757","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258763","label":"bugzilla.suse.com/1258763","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258765","label":"bugzilla.suse.com/1258765","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258769","label":"bugzilla.suse.com/1258769","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258770","label":"bugzilla.suse.com/1258770","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258780","label":"bugzilla.suse.com/1258780","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258786","label":"bugzilla.suse.com/1258786","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258790","label":"bugzilla.suse.com/1258790","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258791","label":"bugzilla.suse.com/1258791","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258792","label":"bugzilla.suse.com/1258792","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258805","label":"bugzilla.suse.com/1258805","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258810","label":"bugzilla.suse.com/1258810","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1258821","label":"bugzilla.suse.com/1258821","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1259017","label":"bugzilla.suse.com/1259017","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24484","label":"www.suse.com/security/cve/CVE-2026-24484","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24485","label":"www.suse.com/security/cve/CVE-2026-24485","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25576","label":"www.suse.com/security/cve/CVE-2026-25576","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25795","label":"www.suse.com/security/cve/CVE-2026-25795","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25796","label":"www.suse.com/security/cve/CVE-2026-25796","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25797","label":"www.suse.com/security/cve/CVE-2026-25797","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25799","label":"www.suse.com/security/cve/CVE-2026-25799","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25966","label":"www.suse.com/security/cve/CVE-2026-25966","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25983","label":"www.suse.com/security/cve/CVE-2026-25983","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25987","label":"www.suse.com/security/cve/CVE-2026-25987","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25988","label":"www.suse.com/security/cve/CVE-2026-25988","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26066","label":"www.suse.com/security/cve/CVE-2026-26066","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26284","label":"www.suse.com/security/cve/CVE-2026-26284","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26983","label":"www.suse.com/security/cve/CVE-2026-26983","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27799","label":"www.suse.com/security/cve/CVE-2026-27799","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-24484","CVE-2026-24485","CVE-2026-25576","CVE-2026-25795","CVE-2026-25796","CVE-2026-25797","CVE-2026-25799","CVE-2026-25966","CVE-2026-25983","CVE-2026-25987","CVE-2026-25988","CVE-2026-26066","CVE-2026-26284","CVE-2026-26983","CVE-2026-27799"],"downstream":[],"duplicates":[],"related":["CVE-2026-24484","CVE-2026-24485","CVE-2026-25576","CVE-2026-25795","CVE-2026-25796","CVE-2026-25797","CVE-2026-25799","CVE-2026-25966","CVE-2026-25983","CVE-2026-25987","CVE-2026-25988","CVE-2026-26066","CVE-2026-26284","CVE-2026-26983","CVE-2026-27799"]},"timeline":[{"kind":"published","date":"2026-03-09T15:34:51.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-03-10T12:45:06.462Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T11:38:21.912Z","stale":false,"partial":false}}