SB2026092139 - Anolis OS update for ImageMagick
Published: September 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 24 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-61862)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the identify command profile display logic when displaying a profile with a non-printable value. A remote attacker can display a crafted profile to disclose sensitive information.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-61464)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the X11 import functionality when processing a crafted window title. A local privileged user can run an X11 import with a crafted window title to cause a denial of service.
User interaction is required to run the import operation.
3) Memory leak (CVE-ID: CVE-2026-61872)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the TIFF encoder when processing an invalid tiff:tile-geometry value. A remote attacker can trick the victim into processing a crafted file to cause a denial of service.
User interaction is required to process the crafted input.
4) Memory leak (CVE-ID: CVE-2026-61871)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the ICON decoder when handling an allocation failure. A remote attacker can trigger allocation failure during processing to cause a denial of service.
5) Memory leak (CVE-ID: CVE-2026-61870)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the VIFF encoder when handling allocation failures. A remote attacker can trigger an allocation failure to cause a denial of service.
6) Memory leak (CVE-ID: CVE-2026-61869)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the MIFF encoder when an allocation fails during encoding. A remote attacker can trigger an allocation failure to cause a denial of service.
7) Memory leak (CVE-ID: CVE-2026-61868)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the YUV decoder when opening a blob fails. A remote attacker can trigger processing of a malformed input to cause a denial of service.
8) Memory leak (CVE-ID: CVE-2026-61867)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in TIFF encoder when an allocation fails during image encoding. A remote attacker can trigger an allocation failure to cause a denial of service.
9) Memory leak (CVE-ID: CVE-2026-61866)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the JNG encoder when opening a blob during JNG file encoding. A remote attacker can trigger a blob open failure to cause a denial of service.
10) Memory leak (CVE-ID: CVE-2026-61865)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the hough lines operation when a specific operation fails. A remote attacker can trigger a failure condition to cause a denial of service.
11) Memory leak (CVE-ID: CVE-2026-61864)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the color transformation to log colorspace operation when transforming an image to the log colorspace and the operation fails. A remote attacker can trigger a failed image transformation to cause a denial of service.
12) Memory leak (CVE-ID: CVE-2026-61863)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the TIFF encoder when a temporary file cannot be created. A remote attacker can trigger creation of a temporary file failure to cause a denial of service.
13) Missing Authorization (CVE-ID: CVE-2026-55628)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and write files in paths disallowed by the security policy.
The vulnerability exists due to missing authorization in the -concatenate operation when processing file paths. A local user can invoke the concatenate operation with disallowed paths to read and write files in paths disallowed by the security policy.
14) Use-after-free (CVE-ID: CVE-2026-61861)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the FormatMagickCaption method when handling memory allocation failure. A remote attacker can trigger a memory allocation failure to cause a denial of service.
15) Use-after-free (CVE-ID: CVE-2026-61860)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the freetype initialization method when handling freetype initialization failures. A remote attacker can trigger a freetype initialization failure to cause a denial of service.
16) Link following (CVE-ID: CVE-2026-61859)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper link resolution before file access in the -script operation when processing script input. A local user can supply a crafted script to disclose sensitive information.
The issue bypasses configured security policy restrictions on disallowed paths.
17) Missing Authorization (CVE-ID: CVE-2026-61858)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass policy restrictions and write to a disallowed path.
The vulnerability exists due to missing authorization in the APNG encoder and external delegates when writing files. A local user can trigger crafted processing to bypass policy restrictions and write to a disallowed path.
18) Use-after-free (CVE-ID: CVE-2026-61857)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the XMP profile parser when parsing an XMP profile. A remote attacker can supply a crafted XMP profile to cause a denial of service.
19) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-61465)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in matrix-backed operations when processing crafted image content. A remote attacker can trigger matrix-based operations such as -canny to cause a denial of service.
User interaction is required to process the crafted image content.
20) Memory leak (CVE-ID: CVE-2026-56375)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due memory leak in the ASHLAR coder. A remote attacker can force the application to leak memory and cause a deial of service condition on the target system.
21) Out-of-bounds read (CVE-ID: CVE-2026-56374)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the FTXT encoder when parsing the ftxt:format value. A remote attacker can provide a specially crafted input to cause a denial of service.
User interaction is required to process the crafted input.
22) Heap-based buffer overflow (CVE-ID: CVE-2026-56372)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the magnify operation when processing an unrecognized magnify:method value. A remote attacker can supply a specially crafted input to cause a denial of service.
User interaction is required to process the crafted input.
23) Memory leak (CVE-ID: CVE-2026-56366)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in the META reader when processing the APP1JPEG input path. A remote attacker can force the application to leak memory and perform denial of service attack.
24) Integer overflow (CVE-ID: CVE-2026-56363)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow leading to division by zero in the binomial kernel when processing a user-supplied large kernel. A remote attacker can supply a specially crafted large binomial kernel to cause a denial of service.
User interaction is required to process the crafted input.
Remediation
Install update from vendor's website.