SB20260914129 - SUSE update for ImageMagick
Published: September 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-55628)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and write files in paths disallowed by the security policy.
The vulnerability exists due to missing authorization in the -concatenate operation when processing file paths. A local user can invoke the concatenate operation with disallowed paths to read and write files in paths disallowed by the security policy.
2) Out-of-bounds read (CVE-ID: CVE-2026-56362)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to a boundary condition in GetPixelIndex. A remote administrator can trigger an out-of-bounds read error and read contents of memory on the system, or perform a deial of service (DoS) attack.
3) Memory leak (CVE-ID: CVE-2026-56366)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in the META reader when processing the APP1JPEG input path. A remote attacker can force the application to leak memory and perform denial of service attack.
4) Use-after-free (CVE-ID: CVE-2026-56373)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the PDB decoder. A remote attacker can perform a denial of service (DoS) attack.
5) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-56377)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to create or truncate files that are disallowed by the security policy.
The vulnerability exists due to time-of-check time-of-use race condition in the policy check logic when handling file creation or truncation operations. A local user can trigger an incorrect check to create or truncate files that are disallowed by the security policy.
This is relevant for sandboxed conversion services that rely on ImageMagick path policies for write-boundary enforcement.
6) Heap-based buffer overflow (CVE-ID: CVE-2026-61464)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the X11 import functionality when processing a crafted window title. A local privileged user can run an X11 import with a crafted window title to cause a denial of service.
User interaction is required to run the import operation.
7) Use-after-free (CVE-ID: CVE-2026-61857)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the XMP profile parser when parsing an XMP profile. A remote attacker can supply a crafted XMP profile to cause a denial of service.
8) Out-of-bounds read (CVE-ID: CVE-2026-61862)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the identify command profile display logic when displaying a profile with a non-printable value. A remote attacker can display a crafted profile to disclose sensitive information.
9) Memory leak (CVE-ID: CVE-2026-61863)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the TIFF encoder when a temporary file cannot be created. A remote attacker can trigger creation of a temporary file failure to cause a denial of service.
10) Memory leak (CVE-ID: CVE-2026-61868)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the YUV decoder when opening a blob fails. A remote attacker can trigger processing of a malformed input to cause a denial of service.
11) Memory leak (CVE-ID: CVE-2026-61869)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the MIFF encoder when an allocation fails during encoding. A remote attacker can trigger an allocation failure to cause a denial of service.
12) Memory leak (CVE-ID: CVE-2026-61870)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the VIFF encoder when handling allocation failures. A remote attacker can trigger an allocation failure to cause a denial of service.
13) Memory leak (CVE-ID: CVE-2026-61872)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the TIFF encoder when processing an invalid tiff:tile-geometry value. A remote attacker can trick the victim into processing a crafted file to cause a denial of service.
User interaction is required to process the crafted input.
Remediation
Install update from vendor's website.