SUSE-SU-2026:3024-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20263024-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3024-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:3024-1
Upstream
CVE (27)
Related
CVE (27)
Published
2026-07-15T09:49:09Z
Modified
2026-07-16T10:00:10Z
Summary
Security update for ImageMagick
Details

This update for ImageMagick fixes the following issues

  • CVE-2026-42050: stack buffer overflow in XTileImage (bsc#1265048).
  • CVE-2026-42326: information disclosure via malicious IPTC input file (bsc#1268092).
  • CVE-2026-45031: denial of Service due to resource policy bypass in PSD decoder (bsc#1268094).
  • CVE-2026-45358: off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder (bsc#1268102).
  • CVE-2026-45624: data exposure due to image processing vulnerability (bsc#1268096).
  • CVE-2026-45664: denial of Service due to excessive resource use in MNG coder (bsc#1268101).
  • CVE-2026-46520: denial of Service via out-of-bounds write when processing multiple images (bsc#1268112).
  • CVE-2026-46521: out of bounds write can occur due to a missing check when using LZMA compression in the MIFF encoder (bsc#1268124).
  • CVE-2026-46522: denial of service via crafted MIFF file due to a missing check in the MIFF decoder (bsc#1268126).
  • CVE-2026-46523: heap-use-after-free via a crafted MSL image (bsc#1268125).
  • CVE-2026-46692: heap buffer over-write in the server process via an attacker who can connect to a magick -distribute- cache service (bsc#1268120).
  • CVE-2026-46693: file descriptor hijacking in the server process when a race condition is met via an attacker who can connect to a magick -distribute-cache service (bsc#1268117).
  • CVE-2026-47165: distributed pixel cache was originally designed to operate without a challenge--response authentication model (bsc#1268114).
  • CVE-2026-47166: heap buffer over-read in the server process via an attacker who can connect to a magick -distribute- cache service (bsc#1268113).
  • CVE-2026-48994: heap buffer over-write due to a missing check of a return value in the MAT decoder on 32-bit systems (bsc#1268111).
  • CVE-2026-49218: denial of service due to a missing check in the DCM decoder (bsc#1268110).
  • CVE-2026-53460: out-of-Memory condition due to a missing check for maximum memory request in AcquireAlignedMemory (bsc#1268108).
  • CVE-2026-53463: null pointer deference due to passing incorrect arguments in the distort operation (bsc#1268105).
  • CVE-2026-53466: heap Buffer Over-Read in XCF decoder due to integer conversion overflow (bsc#1270073).
  • CVE-2026-53467: information Disclosure in MNG decoder because allocated memory is left unchanged (bsc#1270074).
  • CVE-2026-56361: off-by-one origin validation in allows out-of-bounds read in morphology processing (bsc#1270001).
  • CVE-2026-56363: division by Zero in binomial kernel (bsc#1270002).
  • CVE-2026-56365: memory leak in PNG encoder when writing a MNG image (bsc#1270004).
  • CVE-2026-56367: integer overflow in the PSB (PSD v2) RLE decoding path that causes a heap out-of-bounds read (bsc#1268645).
  • CVE-2026-56368: memory leak in multiple coders that write raw pixel data (bsc#1269064).
  • CVE-2026-56371: memory leak in coders/txt.c when processing TXT files with texture attributes (bsc#1268879).
  • CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files (bsc#1268878).
  • GHSA-3j4x-rwrx-xxj9: possible use-after-free write in PDB decoder (bsc#1268640).
References

Affected packages

SUSE:Linux Enterprise Server 12 SP5-LTSS / ImageMagick

Package

Name
ImageMagick
Purl
pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.8.8.1-71.259.1

Ecosystem specific 

{
    "binaries":  [
        {
            "ImageMagick-config-6-SUSE":  "6.8.8.1-71.259.1",
            "ImageMagick-config-6-upstream":  "6.8.8.1-71.259.1",
            "ImageMagick-devel":  "6.8.8.1-71.259.1",
            "libMagick++-devel":  "6.8.8.1-71.259.1",
            "libMagickCore-6_Q16-1":  "6.8.8.1-71.259.1",
            "libMagickWand-6_Q16-1":  "6.8.8.1-71.259.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3024-1.json"

SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 / ImageMagick

Package

Name
ImageMagick
Purl
pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.8.8.1-71.259.1

Ecosystem specific 

{
    "binaries":  [
        {
            "ImageMagick-config-6-SUSE":  "6.8.8.1-71.259.1",
            "ImageMagick-config-6-upstream":  "6.8.8.1-71.259.1",
            "ImageMagick-devel":  "6.8.8.1-71.259.1",
            "libMagick++-devel":  "6.8.8.1-71.259.1",
            "libMagickCore-6_Q16-1":  "6.8.8.1-71.259.1",
            "libMagickWand-6_Q16-1":  "6.8.8.1-71.259.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3024-1.json"