OESA-2026-4680: ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves. Security Fix(es):
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.(CVE-2026-119124)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2.35-1.oe2403sp1 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-34
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using ImageMagick versions before 7.1.2-34 are affected when they process attacker-supplied images with the -morph option. The affected software listed is openeuler/imagemagick.
What does exploitation require?
An attacker must be able to supply a crafted image and have it processed by a user using ImageMagick with the -morph option. The supplied CVSS vector identifies local attack access and user interaction as required.
What is the expected impact?
Processing the crafted image can corrupt heap memory and crash the application. The advisory identifies an availability impact, with no stated confidentiality or integrity impact.