# CVE-2026-28689: ImageMagick: This update for ImageMagick fixes the following issues: - CVE-2026-24484: denial of service via multi-layer nested M... CVE-2026-28689 is fixed in 13 products on 1 platform, first by DEBIAN-CVE-2026-28689, released March 10, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-28689 - Priority: Routine - CVSS: 6.3 (medium) - EPSS: 0.0012 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 10, 2026 ## Description This update for ImageMagick fixes the following issues: - CVE-2026-24484: denial of service via multi-layer nested MVG to SVG conversion (bsc#1258790). - CVE-2026-28493: integer overflow in the SIXEL decoder leads to out-of-bounds write (bsc#1259446). - CVE-2026-28494: missing bounds checks in the morphology kernel parsing functions can lead to a stack buffer overflow (bsc#1259447). - CVE-2026-28686: undersized output buffer allocation in the PCL encoder can lead to a heap buffer overflow (bsc#1259448). - CVE-2026-28687: heap use-after-free vulnerability in the MSL decoder via a crafted MSL file (bsc#1259450). - CVE-2026-28688: heap use-after-free in the MSL encoder when a cloned image is destroyed twice (bsc#1259451). - CVE-2026-28689: `domain='path'` authorization is checked before final file open/use and allows for read/write bypass via symlink swaps (bsc#1259452). - CVE-2026-28690: missing bounds check in the MNG encoder can lead to a stack buffer overflow (bsc#1259456). - CVE-2026-28691: missing check in the JBIG decoder can lead to an uninitialized pointer dereference (bsc#1259455). - CVE-2026-28692: 32-bit integer overflow in MAT decoder can lead to a heap buffer over-read (bsc#1259457). - CVE-2026-28693: integer overflow in the DIB coder can lead to an out-of-bounds read or write (bsc#1259466). - CVE-2026-30883: missing bounds check when encoding a PNG image can lead to a heap buffer over-write (bsc#1259467). - CVE-2026-30929: improper use of fixed-size stack buffer in `MagnifyImage`can lead to a stack buffer overflow (bsc#1259468). - CVE-2026-30936: heap buffer overflow in `WaveletDenoiseImage` (bsc#1259464). - CVE-2026-30937: heap buffer overflow in XWD encoder due to CARD32 arithmetic overflow (bsc#1259463). - CVE-2026-31853: heap buffer overflow leads to crash in the SFW decoder of 32-bit systems when processing extremely large images (bsc#1259528). - CVE-2026-32259: memory allocation failure in the SIXEL encoder can lead to a stack out-of-bound write (bsc#1259612). - CVE-2026-32636: denial of service via out-of-bounds write in `NewXMLTree` method (bsc#1259872). - CVE-2026-33535: out-of-Bounds write of a zero byte in X11 display interaction (bsc#1260874). - CVE-2026-33536: denial of Service via a stack out-of-bounds write in `InterpretImageFilename` (bsc#1260879). - CVE-2026-33905: denial of service via out-of-bounds read in `-sample` operation (bsc#1262097). ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | ImageMagick amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick opensuse-leap 15.6 | 7.1.1.21-150600.3.50.1 | [SUSE-SU-2026:1203-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1203-1.md) | Apr 7, 2026 | | Linux | ImageMagick opensuse-leap 16.0 | 7.1.2.0-160000.7.1 | [OPENSUSE-SU-2026:20405-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20405-1.md) | Mar 20, 2026 | | Linux | ImageMagick sles 15.6 | 7.1.0.9-150400.6.75.1 | [SUSE-SU-2026:1497-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1497-1.md) | Apr 20, 2026 | | Linux | ImageMagick sles 15.6 | 7.1.1.21-150600.3.50.1 | [SUSE-SU-2026:1203-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1203-1.md) | Apr 7, 2026 | | Linux | ImageMagick sles 15.7 | 7.1.0.9-150400.6.75.1 | [SUSE-SU-2026:1497-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1497-1.md) | Apr 20, 2026 | | Linux | ImageMagick sles 16.0 | 7.1.2.0-160000.7.1 | [SUSE-SU-2026:20917-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20917-1.md) | Mar 20, 2026 | | Linux | ImageMagick-c++ amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-c++-debuginfo amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-c++-devel amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-debuginfo amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-debugsource amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-devel amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-doc amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-libs amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-libs-debuginfo amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-perl amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | ImageMagick-perl-debuginfo amzn 2023 | 1:6.9.13.41-1.amzn2023.0.1 | [ALAS2023-2026-1500](https://patchblox.com/security/data/fix/linux/alas2023-2026-1500.md) | Mar 30, 2026 | | Linux | imagemagick Debian 12.15 (bookworm) | 8:6.9.11.60+dfsg-1.6+deb12u8 | [DEBIAN-CVE-2026-28689](https://patchblox.com/security/data/fix/linux/debian-cve-2026-28689.md) | Mar 10, 2026 | | Linux | imagemagick Debian 13.5 (trixie) | 8:7.1.1.43+dfsg1-1+deb13u7 | [DEBIAN-CVE-2026-28689](https://patchblox.com/security/data/fix/linux/debian-cve-2026-28689.md) | Mar 10, 2026 | | Linux | imagemagick Debian 14 | 8:7.1.2.16+dfsg1-1 | [DEBIAN-CVE-2026-28689](https://patchblox.com/security/data/fix/linux/debian-cve-2026-28689.md) | Mar 10, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.