ImageMagick: This update for ImageMagick fixes the following issues - CVE-2026-42050: stack buffer overflow in XTileImage (bsc#12...

This update for ImageMagick fixes the following issues - CVE-2026-42050: stack buffer overflow in XTileImage (bsc#1265048). - CVE-2026-42326: information disclosure via malicious IPTC input file (bsc#1268092). - CVE-2026-45031: denial of Service due to resource policy bypass in PSD decoder (bsc#1268094). - CVE-2026-45358: off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder (bsc#1268102). - CVE-2026-45359: information Disclosure via Invalid Connected-Components Value (bsc#1268095). - CVE-2026-45624: data exposure due to image processing vulnerability (bsc#1268096). - CVE-2026-45664: denial of Service due to excessive resource use in MNG coder (bsc#1268101). - CVE-2026-46520: denial of Service via out-of-bounds write when processing multiple images (bsc#1268112). - CVE-2026-46521: out of bounds write can occur due to a missing check when using LZMA compression in the MIFF encoder (bsc#1268124). - CVE-2026-46522: denial of service via crafted MIFF file due to a missing check in the MIFF decoder (bsc#1268126). - CVE-2026-46523: heap-use-after-free via a crafted MSL image (bsc#1268125). - CVE-2026-46557: stack overflow can occur in the fx operation by passing a crafted argument due to a missing depth check (bsc#1268123). - CVE-2026-46559: heap buffer over-write of a single byte when specifying certain options due to n incorrect check in the JP2 (bsc#1268121). - CVE-2026-46692: heap buffer over-write in the server process via an attacker who can connect to a magick -distribute- cache service (bsc#1268120). - CVE-2026-46693: file descriptor hijacking in the server process when a race condition is met via an attacker who can connect to a magick -distribute-cache service (bsc#1268117). - CVE-2026-47165: distributed pixel cache was originally designed to operate without a challenge--response authentication model (bsc#1268114). - CVE-2026-47166: heap buffer over-read in the server process via an attacker who can connect to a magick -distribute- cache service (bsc#1268113). - CVE-2026-48734: Stack Overflow in MVG decoder (bsc#1268122). - CVE-2026-48994: heap buffer over-write due to a missing check of a return value in the MAT decoder on 32-bit systems (bsc#1268111). - CVE-2026-49218: denial of service due to a missing check in the DCM decoder (bsc#1268110). - CVE-2026-53460: out-of-Memory condition due to a missing check for maximum memory request in AcquireAlignedMemory (bsc#1268108). - CVE-2026-53461: out of bounds heap write due to an incorrect loop in the ICON decoder (bsc#1268107). - CVE-2026-53463: null pointer deference due to passing incorrect arguments in the distort operation (bsc#1268105). - CVE-2026-53464: small memory leak due to providing invalid options to the wand option parser (bsc#1268103). - CVE-2026-53466: heap Buffer Over-Read in XCF decoder due to integer conversion overflow (bsc#1270073). - CVE-2026-53467: information Disclosure in MNG decoder because allocated memory is left unchanged (bsc#1270074). - CVE-2026-55594: stack Overflow in MVG decoder due to missing depth check (bsc#1270077). - CVE-2026-55595: infinite Loop in connected-components when providing invalid arguments (bsc#1270079). - CVE-2026-55597: heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments (bsc#1270080). - CVE-2026-56361: off-by-one origin validation in allows out-of-bounds read in morphology processing (bsc#1270001). - CVE-2026-56363: division by Zero in binomial kernel (bsc#1270002). - CVE-2026-56364: memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML (bsc#1270003). - CVE-2026-56365: memory leak in PNG encoder when writing a MNG image (bsc#1270004). - CVE-2026-56367: integer overflow in the PSB (PSD v2) RLE decoding path that causes a heap out-of-bounds read (bsc#1268645). - CVE-2026-56368: memory leak in multiple coders that write raw pixel data (bsc#1269064). - CVE-2026-56370: out-of-bounds access in `ConnectedComponentsImage()` when processing connected-components:* artifacts with invalid indices (bsc#1269063). - CVE-2026-56371: memory leak in coders/txt.c when processing TXT files with texture attributes (bsc#1268879). - CVE-2026-56374: heap-buffer-overflow in FTXT encoder (bsc#1271099). - CVE-2026-56376: heap use-after-free in the meta coder can lead to denial of service via specially crafted image files (bsc#1268880). - CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files (bsc#1268878). - GHSA-3j4x-rwrx-xxj9: possible use-after-free write in PDB decoder (bsc#1268640).

Where it's fixed