SB2026030625 - Ubuntu update for imagemagick

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-25897)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary error in the sun decoder. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.

2) Out-of-bounds read (CVE-ID: CVE-2026-25898)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary condition within negative pixel index in UIL and XPM writer. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack..

3) Stack-based buffer overflow (CVE-ID: CVE-2026-25968)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary error when processing the an attribute in msl.c. A remote unauthenticated attacker can trigger stack-based buffer overflow and gain access to sensitive information or perform a denial of service (DoS) attack.

4) Use-after-free (CVE-ID: CVE-2026-25983)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in MSLStartElement in MSL decoder. A remote attacker can perform a denial of service (DoS) attack.

5) Out-of-bounds write (CVE-ID: CVE-2026-25986)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. A remote attacker can trigger an out-of-bounds write and perform a denial of service (DoS) attack.

6) Out-of-bounds read (CVE-ID: CVE-2026-25987)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the MAP image decoder when processing crafted MAP files. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.

7) Heap-based buffer overflow (CVE-ID: CVE-2026-26284)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary error in pcd decoder. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and gain acces to sensitive information or perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-8069-1