{ "cveId": "CVE-2026-45624", "url": "https://patchblox.com/security/cve/CVE-2026-45624", "summary": "CVE-2026-45624 is fixed in 13 products on 1 platform, first by DEBIAN-CVE-2026-45624, released May 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "ImageMagick: This update for ImageMagick fixes the following issues\n\n- CVE-2026-42050: stack buffer overflow in XTileImage (bsc#12...", "description": "This update for ImageMagick fixes the following issues\n\n- CVE-2026-42050: stack buffer overflow in XTileImage (bsc#1265048).\n- CVE-2026-42326: information disclosure via malicious IPTC input file (bsc#1268092).\n- CVE-2026-45031: denial of Service due to resource policy bypass in PSD decoder (bsc#1268094).\n- CVE-2026-45358: off by one in the meta encoder could result in an out of bounds read of a single byte in the meta\n encoder (bsc#1268102).\n- CVE-2026-45359: information Disclosure via Invalid Connected-Components Value (bsc#1268095).\n- CVE-2026-45624: data exposure due to image processing vulnerability (bsc#1268096).\n- CVE-2026-45664: denial of Service due to excessive resource use in MNG coder (bsc#1268101).\n- CVE-2026-46520: denial of Service via out-of-bounds write when processing multiple images (bsc#1268112).\n- CVE-2026-46521: out of bounds write can occur due to a missing check when using LZMA compression in the MIFF encoder\n (bsc#1268124).\n- CVE-2026-46522: denial of service via crafted MIFF file due to a missing check in the MIFF decoder (bsc#1268126).\n- CVE-2026-46523: heap-use-after-free via a crafted MSL image (bsc#1268125).\n- CVE-2026-46557: stack overflow can occur in the fx operation by passing a crafted argument due to a missing depth\n check (bsc#1268123).\n- CVE-2026-46559: heap buffer over-write of a single byte when specifying certain options due to n incorrect check in\n the JP2 (bsc#1268121).\n- CVE-2026-46692: heap buffer over-write in the server process via an attacker who can connect to a magick -distribute-\n cache service (bsc#1268120).\n- CVE-2026-46693: file descriptor hijacking in the server process when a race condition is met via an attacker who can\n connect to a magick -distribute-cache service (bsc#1268117).\n- CVE-2026-47165: distributed pixel cache was originally designed to operate without a challenge--response\n authentication model (bsc#1268114).\n- CVE-2026-47166: heap buffer over-read in the server process via an attacker who can connect to a magick -distribute-\n cache service (bsc#1268113).\n- CVE-2026-48734: Stack Overflow in MVG decoder (bsc#1268122).\n- CVE-2026-48994: heap buffer over-write due to a missing check of a return value in the MAT decoder on 32-bit systems\n (bsc#1268111).\n- CVE-2026-49218: denial of service due to a missing check in the DCM decoder (bsc#1268110).\n- CVE-2026-53460: out-of-Memory condition due to a missing check for maximum memory request in AcquireAlignedMemory\n (bsc#1268108).\n- CVE-2026-53461: out of bounds heap write due to an incorrect loop in the ICON decoder (bsc#1268107).\n- CVE-2026-53463: null pointer deference due to passing incorrect arguments in the distort operation (bsc#1268105).\n- CVE-2026-53464: small memory leak due to providing invalid options to the wand option parser (bsc#1268103).\n- CVE-2026-53466: heap Buffer Over-Read in XCF decoder due to integer conversion overflow (bsc#1270073).\n- CVE-2026-53467: information Disclosure in MNG decoder because allocated memory is left unchanged (bsc#1270074).\n- CVE-2026-55594: stack Overflow in MVG decoder due to missing depth check (bsc#1270077).\n- CVE-2026-55595: infinite Loop in connected-components when providing invalid arguments (bsc#1270079).\n- CVE-2026-55597: heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments (bsc#1270080).\n- CVE-2026-56361: off-by-one origin validation in allows out-of-bounds read in morphology processing (bsc#1270001).\n- CVE-2026-56363: division by Zero in binomial kernel (bsc#1270002).\n- CVE-2026-56364: memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML (bsc#1270003).\n- CVE-2026-56365: memory leak in PNG encoder when writing a MNG image (bsc#1270004).\n- CVE-2026-56367: integer overflow in the PSB (PSD v2) RLE decoding path that causes a heap out-of-bounds read\n (bsc#1268645).\n- CVE-2026-56368: memory leak in multiple coders that write raw pixel data (bsc#1269064).\n- CVE-2026-56370: out-of-bounds access in \u0060ConnectedComponentsImage()\u0060 when processing connected-components:* artifacts\n with invalid indices (bsc#1269063).\n- CVE-2026-56371: memory leak in coders/txt.c when processing TXT files with texture attributes (bsc#1268879).\n- CVE-2026-56374: heap-buffer-overflow in FTXT encoder (bsc#1271099).\n- CVE-2026-56376: heap use-after-free in the meta coder can lead to denial of service via specially crafted image files\n (bsc#1268880).\n- CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG\n files (bsc#1268878).\n- GHSA-3j4x-rwrx-xxj9: possible use-after-free write in PDB decoder (bsc#1268640).", "published": "2026-06-10T22:16:58Z", "severity": "medium", "cvss": 5.1, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "epss": 0.0012, "epssPercentile": 0.01848, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "ImageMagick", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick", "release": "opensuse-leap 16.0", "fixedVersion": "7.1.2.0-160000.10.1", "fix": "OPENSUSE-SU-2026:21071-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21071-1", "released": "2026-06-26T09:13:30Z" }, { "platform": "linux", "product": "ImageMagick", "release": "sles 15.6", "fixedVersion": "7.1.1.21-150600.3.73.1", "fix": "SUSE-SU-2026:3023-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3023-1", "released": "2026-07-15T09:48:59Z" }, { "platform": "linux", "product": "ImageMagick", "release": "sles 15.7", "fixedVersion": "7.1.1.43-150700.3.65.1", "fix": "SUSE-SU-2026:2877-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2877-1", "released": "2026-07-13T09:26:26Z" }, { "platform": "linux", "product": "ImageMagick", "release": "sles 16.0", "fixedVersion": "7.1.2.0-160000.10.1", "fix": "SUSE-SU-2026:22378-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22378-1", "released": "2026-06-26T09:12:30Z" }, { "platform": "linux", "product": "ImageMagick-c\u002B\u002B", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-c\u002B\u002B-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-c\u002B\u002B-devel", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-debugsource", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-devel", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-doc", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-libs", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-libs-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-perl", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "ImageMagick-perl-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.9.13.48-1.amzn2023.0.1", "fix": "ALAS2023-2026-1826", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1826", "released": "2026-06-11T09:00:00Z" }, { "platform": "linux", "product": "imagemagick", "release": "Debian 12.15 (bookworm)", "fixedVersion": "8:6.9.11.60\u002Bdfsg-1.6\u002Bdeb12u10", "fix": "DEBIAN-CVE-2026-45624", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-45624", "released": "2026-05-27T17:38:13Z" }, { "platform": "linux", "product": "imagemagick", "release": "Debian 13.5 (trixie)", "fixedVersion": "8:7.1.1.43\u002Bdfsg1-1\u002Bdeb13u9", "fix": "DEBIAN-CVE-2026-45624", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-45624", "released": "2026-05-27T17:38:13Z" }, { "platform": "linux", "product": "imagemagick", "release": "Debian 14", "fixedVersion": "8:7.1.2.23\u002Bdfsg1-1", "fix": "DEBIAN-CVE-2026-45624", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-45624", "released": "2026-05-27T17:38:13Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T13:31:49Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }