# SUSE-SU-2026:4799-1: ImageMagick security update SUSE-SU-2026:4799-1, released November 7, 2026, fixes 37 CVEs in ImageMagick (version 7.1.0.9-150400.6.122.1). None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/suse-su-2026-4799-1 - Platform: Linux - Released: Nov 7, 2026 - Priority: High (Closes CVE-2026-109262, high severity) - CVEs: 37, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:4799-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [ImageMagick](https://patchblox.com/security/data/product/linux/imagemagick-imagemagick.md) | sles 15.6 | 7.1.0.9-150400.6.122.1 | | [ImageMagick](https://patchblox.com/security/data/product/linux/imagemagick-imagemagick.md) | sles 15.7 | 7.1.0.9-150400.6.122.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-106573](https://patchblox.com/security/data/cve/CVE-2026-106573.md) | High | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 7.5 | 0.0044 | | | [CVE-2026-109262](https://patchblox.com/security/data/cve/CVE-2026-109262.md) | High | ImageMagick: Denial of Service via memory leak in SVG encoder (bsc#1285071). | 7.5 | 0.0044 | | | [CVE-2026-106565](https://patchblox.com/security/data/cve/CVE-2026-106565.md) | High | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 7.5 | 0.0042 | | | [CVE-2026-106567](https://patchblox.com/security/data/cve/CVE-2026-106567.md) | High | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 7.5 | 0.0042 | | | [CVE-2026-106578](https://patchblox.com/security/data/cve/CVE-2026-106578.md) | High | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 7.5 | 0.0042 | | | [CVE-2026-109260](https://patchblox.com/security/data/cve/CVE-2026-109260.md) | High | ImageMagick: Denial of Service via memory leak in PNG encoder (bsc#1285071). | 7.5 | 0.0042 | | | [CVE-2026-109261](https://patchblox.com/security/data/cve/CVE-2026-109261.md) | High | ImageMagick: Denial of Service via memory leak in GIF encoder (bsc#1285071). | 7.5 | 0.0042 | | | [CVE-2026-109263](https://patchblox.com/security/data/cve/CVE-2026-109263.md) | High | ImageMagick: Denial of Service via memory leak in YUV encoder (bsc#1285071). | 7.5 | 0.0042 | | | [CVE-2026-109268](https://patchblox.com/security/data/cve/CVE-2026-109268.md) | High | ImageMagick: Denial of Service via use-after-free in PDF writer (bsc#1285071). | 7.5 | 0.0041 | | | [CVE-2026-93589](https://patchblox.com/security/data/cve/CVE-2026-93589.md) | High | ImageMagick: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911). | 7.5 | 0.0034 | | | [CVE-2026-107209](https://patchblox.com/security/data/cve/CVE-2026-107209.md) | High | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 7.5 | 0.0033 | | | [CVE-2026-106579](https://patchblox.com/security/data/cve/CVE-2026-106579.md) | High | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 7.5 | 0.0032 | | | [CVE-2026-106580](https://patchblox.com/security/data/cve/CVE-2026-106580.md) | High | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 8.2 | 0.0027 | | | [CVE-2026-106568](https://patchblox.com/security/data/cve/CVE-2026-106568.md) | Routine | ImageMagick: a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop | 5.3 | 0.0038 | | | [CVE-2026-106572](https://patchblox.com/security/data/cve/CVE-2026-106572.md) | Routine | ImageMagick: a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call | 5.3 | 0.0038 | | | [CVE-2026-109276](https://patchblox.com/security/data/cve/CVE-2026-109276.md) | Routine | ImageMagick: Denial of Service via temporary file leak in JNG decoder (bsc#1285071). | n/a | 0.0038 | | | [CVE-2026-106575](https://patchblox.com/security/data/cve/CVE-2026-106575.md) | Routine | ImageMagick: a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated | 5.3 | 0.0037 | | | [CVE-2026-109278](https://patchblox.com/security/data/cve/CVE-2026-109278.md) | Routine | ImageMagick: Denial of Service via memory leak in wavelet-denoise operation (bsc#1285071). | n/a | 0.0037 | | | [CVE-2026-106577](https://patchblox.com/security/data/cve/CVE-2026-106577.md) | Routine | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 6.5 | 0.0035 | | | [CVE-2026-107210](https://patchblox.com/security/data/cve/CVE-2026-107210.md) | Routine | ImageMagick: a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the | 5.3 | 0.0034 | | | [CVE-2026-109275](https://patchblox.com/security/data/cve/CVE-2026-109275.md) | Routine | ImageMagick: Code injection via crafted MVG file (bsc#1285071). | n/a | 0.0034 | | | [CVE-2026-109259](https://patchblox.com/security/data/cve/CVE-2026-109259.md) | Routine | ImageMagick: Information disclosure via crafted TGA image (bsc#1285071). | n/a | 0.0031 | | | [CVE-2026-109269](https://patchblox.com/security/data/cve/CVE-2026-109269.md) | Routine | ImageMagick: Information disclosure via crafted JPEG file (bsc#1285071). | n/a | 0.0031 | | | [CVE-2026-109273](https://patchblox.com/security/data/cve/CVE-2026-109273.md) | Routine | ImageMagick: Information disclosure via crafted PostScript file (bsc#1285071). | n/a | 0.0031 | | | [CVE-2026-107208](https://patchblox.com/security/data/cve/CVE-2026-107208.md) | Routine | ImageMagick: a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an | 5.3 | 0.0030 | | | [CVE-2026-109266](https://patchblox.com/security/data/cve/CVE-2026-109266.md) | Routine | ImageMagick: XML injection vulnerability in the CIP encoder (bsc#1285071). | 3.6 | 0.0029 | | | [CVE-2026-93588](https://patchblox.com/security/data/cve/CVE-2026-93588.md) | Routine | ImageMagick: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910). | 4.3 | 0.0027 | | | [CVE-2026-106570](https://patchblox.com/security/data/cve/CVE-2026-106570.md) | Routine | ImageMagick: an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache | 6.5 | 0.0022 | | | [CVE-2026-106574](https://patchblox.com/security/data/cve/CVE-2026-106574.md) | Routine | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 6.5 | 0.0021 | | | [CVE-2026-106566](https://patchblox.com/security/data/cve/CVE-2026-106566.md) | Routine | imagemagick: ImageMagick is free and open-source software used for editing and manipulating digital images | 4.4 | 0.0014 | | | [CVE-2026-106571](https://patchblox.com/security/data/cve/CVE-2026-106571.md) | Routine | ImageMagick: a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write | 5.5 | 0.0014 | | | [CVE-2026-109277](https://patchblox.com/security/data/cve/CVE-2026-109277.md) | Routine | ImageMagick: Security policy bypass via -script operation (bsc#1285071). | n/a | 0.0013 | | | [CVE-2026-109274](https://patchblox.com/security/data/cve/CVE-2026-109274.md) | Routine | ImageMagick: Security update for ImageMagick | n/a | 0.0013 | | | [CVE-2026-93587](https://patchblox.com/security/data/cve/CVE-2026-93587.md) | Routine | ImageMagick: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a denial of | n/a | 0.0012 | | | [CVE-2026-109270](https://patchblox.com/security/data/cve/CVE-2026-109270.md) | Routine | ImageMagick: Denial of Service via memory leak in the -process option (bsc#1285071). | n/a | 0.0012 | | | [CVE-2026-105083](https://patchblox.com/security/data/cve/CVE-2026-105083.md) | Routine | ImageMagick: security policy not applied when a user changes the DOCTYPE in the `policy.xml` file to something | 4.2 | 0.0011 | | | [CVE-2026-93586](https://patchblox.com/security/data/cve/CVE-2026-93586.md) | Routine | ImageMagick: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912). | 3.3 | 0.0010 | | --- Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.