OESA-2026-4681: ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves. Security Fix(es):
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.(CVE-2026-119124)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2.35-1.oe2403sp3 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-34
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using ImageMagick versions before 7.1.2-34 are exposed when they process attacker-supplied images with the -morph option. The documented impact is heap-memory corruption and an application crash.
What does an attacker need to exploit it?
An attacker needs to provide a crafted image and have it processed by a user or workflow that invokes ImageMagick with -morph. The supplied vector indicates local attack access and user interaction is required.
Is ImageMagick affected during ordinary image processing?
The available information specifically identifies -morph processing as the vulnerable path. It does not establish that image processing without the -morph option is affected.
What can be done if updating is not immediately possible?
Avoid using the -morph option on untrusted or externally supplied images until ImageMagick is updated to a fixed version. Restrict which users or workflows can submit images for processing where possible.