{
  "cveId": "CVE-2026-30929",
  "url": "https://patchblox.com/security/cve/CVE-2026-30929",
  "summary": "CVE-2026-30929 is fixed in 13 products on 1 platform, first by DEBIAN-CVE-2026-30929, released March 10, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ImageMagick: This update for ImageMagick fixes the following issues:\n\n- CVE-2026-24484: denial of service via multi-layer nested M...",
  "description": "This update for ImageMagick fixes the following issues:\n\n- CVE-2026-24484: denial of service via multi-layer nested MVG to SVG conversion (bsc#1258790).\n- CVE-2026-28493: integer overflow in the SIXEL decoder leads to out-of-bounds write (bsc#1259446).\n- CVE-2026-28494: missing bounds checks in the morphology kernel parsing functions can lead to a stack buffer overflow\n  (bsc#1259447).\n- CVE-2026-28686: undersized output buffer allocation in the PCL encoder can lead to a heap buffer overflow\n  (bsc#1259448).\n- CVE-2026-28687: heap use-after-free vulnerability in the MSL decoder via a crafted MSL file (bsc#1259450).\n- CVE-2026-28688: heap use-after-free in the MSL encoder when a cloned image is destroyed twice (bsc#1259451).\n- CVE-2026-28689: \u0060domain=\u0027path\u0027\u0060 authorization is checked before final file open/use and allows for read/write bypass\n  via symlink swaps (bsc#1259452).\n- CVE-2026-28690: missing bounds check in the MNG encoder can lead to a stack buffer overflow (bsc#1259456).\n- CVE-2026-28691: missing check in the JBIG decoder can lead to an uninitialized pointer dereference (bsc#1259455).\n- CVE-2026-28692: 32-bit integer overflow in MAT decoder can lead to a heap buffer over-read (bsc#1259457).\n- CVE-2026-28693: integer overflow in the DIB coder can lead to an out-of-bounds read or write (bsc#1259466).\n- CVE-2026-30883: missing bounds check when encoding a PNG image can lead to a heap buffer over-write (bsc#1259467).\n- CVE-2026-30929: improper use of fixed-size stack buffer in \u0060MagnifyImage\u0060can lead to a stack buffer overflow\n  (bsc#1259468).\n- CVE-2026-30936: heap buffer overflow in \u0060WaveletDenoiseImage\u0060 (bsc#1259464).\n- CVE-2026-30937: heap buffer overflow in XWD encoder due to CARD32 arithmetic overflow (bsc#1259463).\n- CVE-2026-31853: heap buffer overflow leads to crash in the SFW decoder of 32-bit systems when processing extremely\n  large images (bsc#1259528).\n- CVE-2026-32259: memory allocation failure in the SIXEL encoder can lead to a stack out-of-bound write (bsc#1259612).\n- CVE-2026-32636: denial of service via out-of-bounds write in \u0060NewXMLTree\u0060 method (bsc#1259872).\n- CVE-2026-33535: out-of-Bounds write of a zero byte in X11 display interaction (bsc#1260874).\n- CVE-2026-33536: denial of Service via a stack out-of-bounds write in \u0060InterpretImageFilename\u0060 (bsc#1260879).\n- CVE-2026-33905: denial of service via out-of-bounds read in \u0060-sample\u0060 operation (bsc#1262097).",
  "published": "2026-03-10T07:44:57Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00122,
  "epssPercentile": 0.02023,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ImageMagick",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "7.1.1.21-150600.3.50.1",
      "fix": "SUSE-SU-2026:1203-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1203-1",
      "released": "2026-04-07T12:24:55Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "7.1.2.0-160000.7.1",
      "fix": "OPENSUSE-SU-2026:20405-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20405-1",
      "released": "2026-03-20T09:31:54Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick",
      "release": "sles 15.6",
      "fixedVersion": "7.1.0.9-150400.6.75.1",
      "fix": "SUSE-SU-2026:1497-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1497-1",
      "released": "2026-04-20T16:15:53Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick",
      "release": "sles 15.6",
      "fixedVersion": "7.1.1.21-150600.3.50.1",
      "fix": "SUSE-SU-2026:1203-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1203-1",
      "released": "2026-04-07T12:24:55Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick",
      "release": "sles 15.7",
      "fixedVersion": "7.1.0.9-150400.6.75.1",
      "fix": "SUSE-SU-2026:1497-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1497-1",
      "released": "2026-04-20T16:15:53Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick",
      "release": "sles 16.0",
      "fixedVersion": "7.1.2.0-160000.7.1",
      "fix": "SUSE-SU-2026:20917-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20917-1",
      "released": "2026-03-20T09:31:53Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-c\u002B\u002B",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-c\u002B\u002B-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-c\u002B\u002B-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-doc",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-libs",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-perl",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ImageMagick-perl-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.9.13.41-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1500",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1500",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "imagemagick",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "8:7.1.1.43\u002Bdfsg1-1\u002Bdeb13u7",
      "fix": "DEBIAN-CVE-2026-30929",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-30929",
      "released": "2026-03-10T07:44:57Z"
    },
    {
      "platform": "linux",
      "product": "imagemagick",
      "release": "Debian 14",
      "fixedVersion": "8:7.1.2.16\u002Bdfsg1-1",
      "fix": "DEBIAN-CVE-2026-30929",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-30929",
      "released": "2026-03-10T07:44:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}