OESA-2026-4679: ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves. Security Fix(es):
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.(CVE-2026-119124)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2.35-1.oe2203sp4 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-34
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running ImageMagick versions before 7.1.2-34 are affected when they process attacker-supplied images using the -morph option. The reported impact is heap-memory corruption and an application crash.
What does an attacker need to exploit it?
An attacker needs to provide a crafted image and have it processed by a user with ImageMagick's -morph option. The supplied severity vector indicates local attack access and user interaction are required, while no privileges are required.
Are normal ImageMagick image-processing workflows affected by default?
The issue is specifically described in -morph processing. The provided information does not establish that workflows not using -morph are affected.
What should be done if immediate patching is not possible?
Avoid processing untrusted images with the -morph option until an updated ImageMagick version is deployed. This directly removes the processing path identified as vulnerable.