OESA-2026-4682: ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves. Security Fix(es):
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.(CVE-2026-119124)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2.35-1.oe2403sp4 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-34
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when ImageMagick processes attacker-supplied images with the -morph option. The reported impact is heap-memory corruption that can crash the application.
What does an attacker need to exploit it?
An attacker needs to supply a crafted image and have it processed by a user using ImageMagick's -morph option. The advisory does not indicate that authentication or prior privileges are required.
Are all ImageMagick image-processing workflows affected?
The issue is specifically described in -morph processing. The provided information does not establish that workflows which do not use -morph are affected.
How can I determine whether my deployment is affected?
Check whether the deployed ImageMagick version is earlier than 7.1.2-34 and whether your image-processing commands or applications invoke the -morph option. Affected processing of crafted input may result in an application crash.