-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 23 Oct 2026 21:46:42 +0200 Source: imagemagick Architecture: source Version: 8:7.1.1.43+dfsg1-1+deb13u13 Distribution: trixie-security Urgency: medium Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Closes: 1147176 1149974 1150224 1150337 Changes: imagemagick (8:7.1.1.43+dfsg1-1+deb13u13) trixie-security; urgency=medium . * Security fixes (Closes: #1147176, #1149974, #1150337) * Fix regression of CVE-2026-25971: SVG <image> with data: URI fails ("unable to open image") (Closes: #1150224) * Port distribute cache to 7.1.2.33 * Port coders/mat.c to 7.1.2.33 * Fix CVE-2026-62343: An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. * Fix CVE-2026-62946: Processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. * Fix CVE-2026-62363: A heap buffer over-write can occur in the fx operation by passing a crafted argument. * Fix CVE-2026-64685: The BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. * Fix CVE-2026-86420: Imagemagick fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service. * Fix CVE-2026-86421 Fix a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service. * Fix CVE-2026-86423: a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service). * Fix CVE-2026-86424: A time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps * Fix CVE-2026-86425: A heap-use-after-free vulnerability in the Layer method of PerlMagick. * Fix CVE-2026-93586: A use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). * Fix CVE-2026-93587: A policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. * Fix CVE-2026-93588: a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image. * Fix CVE-2026-93589: A division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. * Fix CVE-2026-93590: a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation. * Fix CVE-2026-102635: imagemagick contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information. * Fix CVE-2026-106564: A crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. * Fix CVE-2026-106565: A missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. * Fix CVE-2026-106566: Delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. * Fix CVE-2026-106567: A crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. * Fix CVE-2026-106568: A crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. * Fix CVE-2026-106570: An unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. * Fix CVE-2026-106571: A crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. * Fix CVE-2026-106572: A missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. * Fix CVE-2026-106573: a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. * Fix CVE-2026-106574: A client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. * Fix CVE-2026-106575: A crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors * Fix CVE-2026-106576: A crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service * Fix CVE-2026-106577: Unescaped or untrimmed values can inject code into output generated by PostScript coders. * Fix CVE-2026-106578: A crafted image can cause an invalid memory free in the MVG decoder and crash the process * Fix CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. * Fix CVE-2026-106580: a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. * Fix CVE-2026-107208: Denial of service with crafted XMP profile * Fix CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process * Fix CVE-2026-107210: A crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. * Fix CVE-2026-109261: imagemagick contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability. * Fix GHSA-83w9-w85j-h9jc: Memory Leak in MAT decoder in an error path. Checksums-Sha1: 42f447bb6abea3feb7b3f3312b7901a065244508 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u13.dsc 103af0af388a733c043845b228cf3031c16d859b 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz 5b772a7cfd13900061961d0760acd1e2760e26ae 403292 imagemagick_7.1.1.43+dfsg1-1+deb13u13.debian.tar.xz 88778a357561066add669f35cc70de5f4dadb8b9 8958 imagemagick_7.1.1.43+dfsg1-1+deb13u13_source.buildinfo Checksums-Sha256: bbd83d09b7e11a0c13b0334bb6703abf86359243d5283a0b0edbbe47e187ebca 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u13.dsc bcb4f3c78a930a608fa4889f889edbcb384974246ad9407fce1858f2c0607bfe 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz 4a1dfe533644f2c567ba474af9e78fca20e6d84535aafce42fe1ff6a03d593db 403292 imagemagick_7.1.1.43+dfsg1-1+deb13u13.debian.tar.xz d08373fb5f0cce5198a5605a775c6ba2850348ff02c9f5e51b8c0048d908d523 8958 imagemagick_7.1.1.43+dfsg1-1+deb13u13_source.buildinfo Files: 1d310e55237548a9fd047c04754cba1e 5165 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u13.dsc 01cfb13a7c1813afb50790e431358c6c 10501740 graphics optional imagemagick_7.1.1.43+dfsg1.orig.tar.xz 76399ec6da40722298e3c5b47ce56e28 403292 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u13.debian.tar.xz 9fe0e7c6614b9db333e1026ffecf38f0 8958 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u13_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmriACoACgkQADoaLapB CF/OfA//VykQokzOxS7QGif+UsNr40JvF8JhnMRseIySmFGw8UMtfn6URM5e0F2T ZcJvEOxnm3f17lCAR8BQjrEo0r/O7C0tr80BQiSx4Ex5kd9Xp4FvXr6QENMXJbKM jkaieLvAFIXpaHtluQr1Yn1aTTHuE5vjFVjuv+qRvCl0QUj9QBc/5B4kd9+m4s4J Ud3cKeWBACozLYmzahcCqBa9vIV+1WeVlNQGOx56knEn8Rp8YmT6dgKvv9/WbavM fbESOkkYNYcK9HkwdQRHI0GB/Y1pU5JIpWDDjwpuP/GNhX+gztvHAcbmffumQjCh GSU5lYQN8PM1ctZdBe6DG3dbx93oabT7D1FfjBKiTPUb8iszOZYQ+rfvdx7PDVW+ TGqUwSXT+/m21XsvhNI/vXFiuQe70KaDjqeC6QHOpZLOlFgEuPljbpR9fi2Y6Er9 p4y5RfdaQfwAsRTxP4vtU5Z/3Dmjo63NvafiSae6A/Pdv1XMKZSXbxalh0AY4xPD HK68GbWASjvPzuqYF70eYgI6/Bzt8zrEOwh3vSx4vq4F789Cq3OH+B3dtkJdLD2y L8b50QoMCZJL/WZQTo1MOjmFG8FlUhvu14LXzAXLvTAV8l9XXBWjcIhE9hp5KMvc +OsEhba8kPxARZX0Hwn8XygaxiMy55CzOEpgN+hcLs74B+BLbfs= =ix1H -----END PGP SIGNATURE-----
