SB20260914133 - SUSE update for ImageMagick
Published: September 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 vulnerabilities.
1) Link following (CVE-ID: CVE-2026-61859)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper link resolution before file access in the -script operation when processing script input. A local user can supply a crafted script to disclose sensitive information.
The issue bypasses configured security policy restrictions on disallowed paths.
2) Memory leak (CVE-ID: CVE-2026-61872)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the TIFF encoder when processing an invalid tiff:tile-geometry value. A remote attacker can trick the victim into processing a crafted file to cause a denial of service.
User interaction is required to process the crafted input.
3) Memory leak (CVE-ID: CVE-2026-61870)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the VIFF encoder when handling allocation failures. A remote attacker can trigger an allocation failure to cause a denial of service.
4) Memory leak (CVE-ID: CVE-2026-61869)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the MIFF encoder when an allocation fails during encoding. A remote attacker can trigger an allocation failure to cause a denial of service.
5) Memory leak (CVE-ID: CVE-2026-61868)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the YUV decoder when opening a blob fails. A remote attacker can trigger processing of a malformed input to cause a denial of service.
6) Memory leak (CVE-ID: CVE-2026-61867)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in TIFF encoder when an allocation fails during image encoding. A remote attacker can trigger an allocation failure to cause a denial of service.
7) Memory leak (CVE-ID: CVE-2026-61866)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the JNG encoder when opening a blob during JNG file encoding. A remote attacker can trigger a blob open failure to cause a denial of service.
8) Memory leak (CVE-ID: CVE-2026-61865)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the hough lines operation when a specific operation fails. A remote attacker can trigger a failure condition to cause a denial of service.
9) Memory leak (CVE-ID: CVE-2026-61864)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the color transformation to log colorspace operation when transforming an image to the log colorspace and the operation fails. A remote attacker can trigger a failed image transformation to cause a denial of service.
10) Memory leak (CVE-ID: CVE-2026-61863)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the TIFF encoder when a temporary file cannot be created. A remote attacker can trigger creation of a temporary file failure to cause a denial of service.
11) Out-of-bounds read (CVE-ID: CVE-2026-61862)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the identify command profile display logic when displaying a profile with a non-printable value. A remote attacker can display a crafted profile to disclose sensitive information.
12) Use-after-free (CVE-ID: CVE-2026-61861)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the FormatMagickCaption method when handling memory allocation failure. A remote attacker can trigger a memory allocation failure to cause a denial of service.
13) Use-after-free (CVE-ID: CVE-2026-61860)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the freetype initialization method when handling freetype initialization failures. A remote attacker can trigger a freetype initialization failure to cause a denial of service.
14) Missing Authorization (CVE-ID: CVE-2026-55628)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and write files in paths disallowed by the security policy.
The vulnerability exists due to missing authorization in the -concatenate operation when processing file paths. A local user can invoke the concatenate operation with disallowed paths to read and write files in paths disallowed by the security policy.
15) Missing Authorization (CVE-ID: CVE-2026-61858)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass policy restrictions and write to a disallowed path.
The vulnerability exists due to missing authorization in the APNG encoder and external delegates when writing files. A local user can trigger crafted processing to bypass policy restrictions and write to a disallowed path.
16) Use-after-free (CVE-ID: CVE-2026-61857)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the XMP profile parser when parsing an XMP profile. A remote attacker can supply a crafted XMP profile to cause a denial of service.
17) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-61465)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in matrix-backed operations when processing crafted image content. A remote attacker can trigger matrix-based operations such as -canny to cause a denial of service.
User interaction is required to process the crafted image content.
18) Heap-based buffer overflow (CVE-ID: CVE-2026-61464)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the X11 import functionality when processing a crafted window title. A local privileged user can run an X11 import with a crafted window title to cause a denial of service.
User interaction is required to run the import operation.
19) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-56379)
CWE-ID: CWE-116 - Improper Encoding or Escaping of Output
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary commands on the system.
The vulnerability exists due to improper encoding or escaping of output within coders/svg.c. A remote attacker can pass specially crafted data to the application and execute arbitrary commands.
20) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-56377)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to create or truncate files that are disallowed by the security policy.
The vulnerability exists due to time-of-check time-of-use race condition in the policy check logic when handling file creation or truncation operations. A local user can trigger an incorrect check to create or truncate files that are disallowed by the security policy.
This is relevant for sandboxed conversion services that rely on ImageMagick path policies for write-boundary enforcement.
21) Memory leak (CVE-ID: CVE-2026-56375)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due memory leak in the ASHLAR coder. A remote attacker can force the application to leak memory and cause a deial of service condition on the target system.
22) Use-after-free (CVE-ID: CVE-2026-56373)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the PDB decoder. A remote attacker can perform a denial of service (DoS) attack.
23) Heap-based buffer overflow (CVE-ID: CVE-2026-56372)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the magnify operation when processing an unrecognized magnify:method value. A remote attacker can supply a specially crafted input to cause a denial of service.
User interaction is required to process the crafted input.
24) Memory leak (CVE-ID: CVE-2026-56366)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in the META reader when processing the APP1JPEG input path. A remote attacker can force the application to leak memory and perform denial of service attack.
25) Out-of-bounds read (CVE-ID: CVE-2026-56362)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to a boundary condition in GetPixelIndex. A remote administrator can trigger an out-of-bounds read error and read contents of memory on the system, or perform a deial of service (DoS) attack.
Remediation
Install update from vendor's website.