DEBIAN-CVE-2026-119123: Low severity debian/imagemagick vulnerability
ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.34+dfsg1-1 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-34
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions before 7.1.2-34 are affected when the TIFF decoder is in use and the DNG decoder is disabled. The reported impact is an application crash rather than loss of confidentiality or integrity.
What does an attacker need to do to trigger the vulnerability?
An attacker must be able to provide a crafted image file that the application processes. Exploitation is network-reachable in the reported vector, requires no privileges or user interaction, but has high attack complexity.
Is the default configuration affected?
The issue occurs specifically when the DNG decoder is disabled. The provided data does not state whether that decoder is disabled by default in Debian ImageMagick installations.
What can be done if upgrading is not immediately possible?
Limit or avoid processing untrusted image files, particularly TIFF/DNG-related inputs, until ImageMagick can be updated to 7.1.2-34 or later. Isolate image-processing workloads so a crash does not disrupt other services.