SUSE-SU-2026:4799-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-20264799-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4799-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:4799-1
- Upstream
CVE (37)
- CVE-2026-105083
- CVE-2026-106565
- CVE-2026-106566
- CVE-2026-106567
- CVE-2026-106568
- CVE-2026-106570
- CVE-2026-106571
- CVE-2026-106572
- CVE-2026-106573
- CVE-2026-106574
- CVE-2026-106575
- CVE-2026-106577
- CVE-2026-106578
- CVE-2026-106579
- CVE-2026-106580
- CVE-2026-107208
- CVE-2026-107209
- CVE-2026-107210
- CVE-2026-109259
- CVE-2026-109260
- CVE-2026-109261
- CVE-2026-109262
- CVE-2026-109263
- CVE-2026-109266
- CVE-2026-109268
- CVE-2026-109269
- CVE-2026-109270
- CVE-2026-109273
- CVE-2026-109274
- CVE-2026-109275
- CVE-2026-109276
- CVE-2026-109277
- CVE-2026-109278
- CVE-2026-93586
- CVE-2026-93587
- CVE-2026-93588
- CVE-2026-93589
- Related
- Published
- 2026-10-21T07:57:03Z
- Modified
- 2026-10-21T20:01:39Z
- Summary
- Security update for ImageMagick
- Details
-
This update for ImageMagick fixes the following issues:
- CVE-2026-93586: use-after-free in the
ImagesToBlobmethod can lead to a process crash (bsc#1281912). - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a denial of service (bsc#1281909).
- CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
- CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
- CVE-2026-105083: security policy not applied when a user changes the DOCTYPE in the
policy.xmlfile to something else that is valid xml (bsc#1284217). - CVE-2026-106565: a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop (bsc#1284662).
- CVE-2026-106566: delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file with random data (bsc#1284663).
- CVE-2026-106567: a crafted PSD file can trigger an integer-conversion error in the PSD decoder, causing an infinite loop and DoS (bsc#1284664).
- CVE-2026-106568: a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop (bsc#1284665).
- CVE-2026-106570: an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing a DoS (bsc#1284667).
- CVE-2026-106571: a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process (bsc#1284668).
- CVE-2026-106572: a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process (bsc#1284669).
- CVE-2026-106573: a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long- running operation (bsc#1284671).
- CVE-2026-106574: a client connected to the distributed pixel cache server can send crafted pixel data that triggers a heap buffer overwrite and crash the server (bsc#1284672).
- CVE-2026-106575: a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors (bsc#1284673).
- CVE-2026-106577: unescaped or untrimmed values can inject code into output generated by PostScript coders (bsc#1284675).
- CVE-2026-106578: a crafted image can cause an invalid memory free in the MVG decoder and crash the process (bsc#1284677).
- CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read (bsc#1284678).
- CVE-2026-106580: a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash (bsc#1284680).
- CVE-2026-107208: a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process (bsc#1284681).
- CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause a crash (bsc#1284682).
- CVE-2026-107210: a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit (bsc#1284683).
- CVE-2026-109259: Information disclosure via crafted TGA image (bsc#1285071).
- CVE-2026-109260: Denial of Service via memory leak in PNG encoder (bsc#1285071).
- CVE-2026-109261: Denial of Service via memory leak in GIF encoder (bsc#1285071).
- CVE-2026-109262: Denial of Service via memory leak in SVG encoder (bsc#1285071).
- CVE-2026-109263: Denial of Service via memory leak in YUV encoder (bsc#1285071).
- CVE-2026-109266: XML injection vulnerability in the CIP encoder (bsc#1285071).
- CVE-2026-109268: Denial of Service via use-after-free in PDF writer (bsc#1285071).
- CVE-2026-109269: Information disclosure via crafted JPEG file (bsc#1285071).
- CVE-2026-109270: Denial of Service via memory leak in the -process option (bsc#1285071).
- CVE-2026-109273: Information disclosure via crafted PostScript file (bsc#1285071).
- CVE-2026-109275: Code injection via crafted MVG file (bsc#1285071).
- CVE-2026-109276: Denial of Service via temporary file leak in JNG decoder (bsc#1285071).
- CVE-2026-109277: Security policy bypass via -script operation (bsc#1285071).
- CVE-2026-109278: Denial of Service via memory leak in wavelet-denoise operation (bsc#1285071).
- CVE-2026-93586: use-after-free in the
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-20264799-1/
- https://bugzilla.suse.com/1268113
- https://bugzilla.suse.com/1268117
- https://bugzilla.suse.com/1281909
- https://bugzilla.suse.com/1281910
- https://bugzilla.suse.com/1281911
- https://bugzilla.suse.com/1281912
- https://bugzilla.suse.com/1284217
- https://bugzilla.suse.com/1284662
- https://bugzilla.suse.com/1284663
- https://bugzilla.suse.com/1284664
- https://bugzilla.suse.com/1284665
- https://bugzilla.suse.com/1284667
- https://bugzilla.suse.com/1284668
- https://bugzilla.suse.com/1284669
- https://bugzilla.suse.com/1284671
- https://bugzilla.suse.com/1284672
- https://bugzilla.suse.com/1284673
- https://bugzilla.suse.com/1284675
- https://bugzilla.suse.com/1284677
- https://bugzilla.suse.com/1284678
- https://bugzilla.suse.com/1284680
- https://bugzilla.suse.com/1284681
- https://bugzilla.suse.com/1284682
- https://bugzilla.suse.com/1284683
- https://bugzilla.suse.com/1285071
- https://www.suse.com/security/cve/CVE-2026-105083
- https://www.suse.com/security/cve/CVE-2026-106565
- https://www.suse.com/security/cve/CVE-2026-106566
- https://www.suse.com/security/cve/CVE-2026-106567
- https://www.suse.com/security/cve/CVE-2026-106568
- https://www.suse.com/security/cve/CVE-2026-106570
- https://www.suse.com/security/cve/CVE-2026-106571
- https://www.suse.com/security/cve/CVE-2026-106572
- https://www.suse.com/security/cve/CVE-2026-106573
- https://www.suse.com/security/cve/CVE-2026-106574
- https://www.suse.com/security/cve/CVE-2026-106575
- https://www.suse.com/security/cve/CVE-2026-106577
- https://www.suse.com/security/cve/CVE-2026-106578
- https://www.suse.com/security/cve/CVE-2026-106579
- https://www.suse.com/security/cve/CVE-2026-106580
- https://www.suse.com/security/cve/CVE-2026-107208
- https://www.suse.com/security/cve/CVE-2026-107209
- https://www.suse.com/security/cve/CVE-2026-107210
- https://www.suse.com/security/cve/CVE-2026-109259
- https://www.suse.com/security/cve/CVE-2026-109260
- https://www.suse.com/security/cve/CVE-2026-109261
- https://www.suse.com/security/cve/CVE-2026-109262
- https://www.suse.com/security/cve/CVE-2026-109263
- https://www.suse.com/security/cve/CVE-2026-109266
- https://www.suse.com/security/cve/CVE-2026-109268
- https://www.suse.com/security/cve/CVE-2026-109269
- https://www.suse.com/security/cve/CVE-2026-109270
- https://www.suse.com/security/cve/CVE-2026-109273
- https://www.suse.com/security/cve/CVE-2026-109274
- https://www.suse.com/security/cve/CVE-2026-109275
- https://www.suse.com/security/cve/CVE-2026-109276
- https://www.suse.com/security/cve/CVE-2026-109277
- https://www.suse.com/security/cve/CVE-2026-109278
- https://www.suse.com/security/cve/CVE-2026-93586
- https://www.suse.com/security/cve/CVE-2026-93587
- https://www.suse.com/security/cve/CVE-2026-93588
- https://www.suse.com/security/cve/CVE-2026-93589
Affected packages
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
Ecosystem specific
{
"binaries": [
{
"ImageMagick": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-SUSE": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-upstream": "7.1.0.9-150400.6.122.1",
"ImageMagick-devel": "7.1.0.9-150400.6.122.1",
"libMagick++-7_Q16HDRI5": "7.1.0.9-150400.6.122.1",
"libMagick++-devel": "7.1.0.9-150400.6.122.1",
"libMagickCore-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"libMagickWand-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"perl-PerlMagick": "7.1.0.9-150400.6.122.1"
}
]
}SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
Ecosystem specific
{
"binaries": [
{
"ImageMagick": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-SUSE": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-upstream": "7.1.0.9-150400.6.122.1",
"ImageMagick-devel": "7.1.0.9-150400.6.122.1",
"libMagick++-7_Q16HDRI5": "7.1.0.9-150400.6.122.1",
"libMagick++-devel": "7.1.0.9-150400.6.122.1",
"libMagickCore-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"libMagickWand-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"perl-PerlMagick": "7.1.0.9-150400.6.122.1"
}
]
}SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
Ecosystem specific
{
"binaries": [
{
"ImageMagick": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-SUSE": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-upstream": "7.1.0.9-150400.6.122.1",
"ImageMagick-devel": "7.1.0.9-150400.6.122.1",
"libMagick++-7_Q16HDRI5": "7.1.0.9-150400.6.122.1",
"libMagick++-devel": "7.1.0.9-150400.6.122.1",
"libMagickCore-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"libMagickWand-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"perl-PerlMagick": "7.1.0.9-150400.6.122.1"
}
]
}SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
Ecosystem specific
{
"binaries": [
{
"ImageMagick": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-SUSE": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-upstream": "7.1.0.9-150400.6.122.1",
"ImageMagick-devel": "7.1.0.9-150400.6.122.1",
"libMagick++-7_Q16HDRI5": "7.1.0.9-150400.6.122.1",
"libMagick++-devel": "7.1.0.9-150400.6.122.1",
"libMagickCore-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"libMagickWand-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"perl-PerlMagick": "7.1.0.9-150400.6.122.1"
}
]
}SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
SUSE:Linux Enterprise Server 15 SP4-LTSS
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
Ecosystem specific
{
"binaries": [
{
"ImageMagick": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-SUSE": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-upstream": "7.1.0.9-150400.6.122.1",
"ImageMagick-devel": "7.1.0.9-150400.6.122.1",
"libMagick++-7_Q16HDRI5": "7.1.0.9-150400.6.122.1",
"libMagick++-devel": "7.1.0.9-150400.6.122.1",
"libMagickCore-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"libMagickWand-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"perl-PerlMagick": "7.1.0.9-150400.6.122.1"
}
]
}SUSE:Linux Enterprise Server 15 SP5-LTSS
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
Ecosystem specific
{
"binaries": [
{
"ImageMagick": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-SUSE": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-upstream": "7.1.0.9-150400.6.122.1",
"ImageMagick-devel": "7.1.0.9-150400.6.122.1",
"libMagick++-7_Q16HDRI5": "7.1.0.9-150400.6.122.1",
"libMagick++-devel": "7.1.0.9-150400.6.122.1",
"libMagickCore-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"libMagickWand-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"perl-PerlMagick": "7.1.0.9-150400.6.122.1"
}
]
}SUSE:Linux Enterprise Server 15 SP6-LTSS
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
Ecosystem specific
{
"binaries": [
{
"ImageMagick": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-SUSE": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-upstream": "7.1.0.9-150400.6.122.1",
"ImageMagick-devel": "7.1.0.9-150400.6.122.1",
"libMagick++-7_Q16HDRI5": "7.1.0.9-150400.6.122.1",
"libMagick++-devel": "7.1.0.9-150400.6.122.1",
"libMagickCore-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"libMagickWand-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"perl-PerlMagick": "7.1.0.9-150400.6.122.1"
}
]
}SUSE:Linux Enterprise Server for SAP Applications 15 SP5
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1
Ecosystem specific
{
"binaries": [
{
"ImageMagick": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-SUSE": "7.1.0.9-150400.6.122.1",
"ImageMagick-config-7-upstream": "7.1.0.9-150400.6.122.1",
"ImageMagick-devel": "7.1.0.9-150400.6.122.1",
"libMagick++-7_Q16HDRI5": "7.1.0.9-150400.6.122.1",
"libMagick++-devel": "7.1.0.9-150400.6.122.1",
"libMagickCore-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"libMagickWand-7_Q16HDRI10": "7.1.0.9-150400.6.122.1",
"perl-PerlMagick": "7.1.0.9-150400.6.122.1"
}
]
}SUSE:Linux Enterprise Server for SAP Applications 15 SP6
ImageMagick
Package
- Name
- ImageMagick
- Purl
- pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.1.0.9-150400.6.122.1