SB2026091498 - Debian update for imagemagick
Published: September 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 vulnerabilities.
1) Memory leak (CVE-ID: CVE-2026-56364)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform DoS attack on the target system.
The vulnerability exists due memory leak in the "LoadOpenCLDeviceBenchmark()" function in MagickCore/opencl.c. A local administrator can force the application to leak memory and perform denial of service attack.
2) Out-of-bounds read (CVE-ID: CVE-2026-56378)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the PCD coder’s DecodeImage loop. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.
3) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-56377)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to create or truncate files that are disallowed by the security policy.
The vulnerability exists due to time-of-check time-of-use race condition in the policy check logic when handling file creation or truncation operations. A local user can trigger an incorrect check to create or truncate files that are disallowed by the security policy.
This is relevant for sandboxed conversion services that rely on ImageMagick path policies for write-boundary enforcement.
4) Use-after-free (CVE-ID: CVE-2026-56376)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in meta coder. A remote attacker can pass specially crafted image to the application, trigger a use-after-free error and execute arbitrary code on the system.
5) Memory leak (CVE-ID: CVE-2026-56371)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in coders/txt.c without freetype. A remote attacker can force the application to leak memory and perform denial of service attack.
6) Out-of-bounds write (CVE-ID: CVE-2026-56370)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in ConnectedComponentsImage() when processing an invalid index in CLI-controlled connected-components:* artifacts. A remote attacker can supply a specially crafted define value to cause a denial of service.
User interaction is required to process the crafted input.
7) Memory leak (CVE-ID: CVE-2026-56368)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in multiple coders that write raw pixel data. A remote attacker can force the application to leak memory and perform denial of service attack.
8) Out-of-bounds read (CVE-ID: CVE-2026-56367)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the PSB (PSD v2) RLE decoding path. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.
9) Memory leak (CVE-ID: CVE-2026-56365)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the PNG encoder when writing an MNG image. A remote attacker can trigger a failure while writing an MNG image to cause a denial of service.
10) Integer overflow (CVE-ID: CVE-2026-53466)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.
The vulnerability exists due to integer overflow in the XCF decoder when parsing a crafted image. A remote attacker can supply a specially crafted image to cause a denial of service and disclose sensitive information.
11) Integer overflow (CVE-ID: CVE-2026-56363)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow leading to division by zero in the binomial kernel when processing a user-supplied large kernel. A remote attacker can supply a specially crafted large binomial kernel to cause a denial of service.
User interaction is required to process the crafted input.
12) Out-of-bounds read (CVE-ID: CVE-2026-56361)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an off-by-one error resulting in an out-of-bounds read in morphology processing when processing an incorrect morphology. A remote attacker can supply a crafted morphology input to cause a denial of service.
User interaction is required to process the crafted input.
13) Missing Authorization (CVE-ID: CVE-2026-55628)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and write files in paths disallowed by the security policy.
The vulnerability exists due to missing authorization in the -concatenate operation when processing file paths. A local user can invoke the concatenate operation with disallowed paths to read and write files in paths disallowed by the security policy.
14) Out-of-bounds write (CVE-ID: CVE-2026-55597)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the JP2 encoder when parsing a crafted JP2 file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
User interaction is required to open a crafted file.
15) Uncontrolled Recursion (CVE-ID: CVE-2026-55594)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the MVG decoder when parsing a crafted image. A remote attacker can supply a crafted image to cause a denial of service.
16) Out-of-bounds write (CVE-ID: CVE-2026-55577)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the MVG decoder when processing a crafted image. A remote attacker can supply a specially crafted image to cause a denial of service.
17) Information disclosure (CVE-ID: CVE-2026-53467)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to heap information disclosure in the MNG decoder when parsing crafted MNG images. A remote attacker can supply a crafted MNG image to disclose sensitive information.
Remediation
Install update from vendor's website.