SUSE-SU-2026:5095-1: Security update for GraphicsMagick

Q: Which systems are affected by this issue?

The issue affects 32-bit systems using GraphicsMagick components covered by this update, including the GraphicsMagick libraries, tools, development packages, and Perl bindings listed in the advisory.

Q: What would an attacker need to trigger the vulnerability?

An attacker would need to cause GraphicsMagick to process a PICT image. The provided information identifies the vulnerable component as the PICT decoder but does not specify a delivery vector or required privileges.

Q: How can I determine whether I need this update?

Check whether the system is 32-bit and has any of the listed GraphicsMagick packages installed. Systems that do not process PICT images are not identified as unaffected by the advisory, but the vulnerable code is specifically the PICT decoder.

Published Nov 4, 2026

Updated

This update for GraphicsMagick fixes the following issue:

- CVE-2026-109964: heap buffer overwrite in PICT decoder on 32-bit systems (bsc#1285423).

Other sources

This update for GraphicsMagick fixes the following issue: CVE-2026-109964: heap buffer overwrite in PICT decoder on 32-bit systems (bsc#1285423).

— SUSE

Affected Software

25 affected componentsFixes available

suse/graphicsmagick<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

All of the following

SUSE openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64)

Any of the following

suse/graphicsmagick-devel<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/graphicsmagick<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/libgraphicsmagick-q16<3-debuginfo-1.3.42-150600.3.51.1

3-debuginfo-1.3.42-150600.3.51.1

suse/graphicsmagick-debugsource<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/perl-graphicsmagick<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/perl-graphicsmagick-debuginfo<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/libgraphicsmagick-q16<3-1.3.42-150600.3.51.1

3-1.3.42-150600.3.51.1

suse/libgraphicsmagickwand-q16<2-debuginfo-1.3.42-150600.3.51.1

2-debuginfo-1.3.42-150600.3.51.1

suse/graphicsmagick-debuginfo<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/libgraphicsmagick3-config<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/libgraphicsmagickwand-q16<2-1.3.42-150600.3.51.1

2-1.3.42-150600.3.51.1

All of the following

SUSE SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/graphicsmagick-devel<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/graphicsmagick<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/libgraphicsmagick-q16<3-debuginfo-1.3.42-150600.3.51.1

3-debuginfo-1.3.42-150600.3.51.1

suse/graphicsmagick-debugsource<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/perl-graphicsmagick<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/perl-graphicsmagick-debuginfo<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/libgraphicsmagick-q16<3-1.3.42-150600.3.51.1

3-1.3.42-150600.3.51.1

suse/libgraphicsmagickwand-q16<2-debuginfo-1.3.42-150600.3.51.1

2-debuginfo-1.3.42-150600.3.51.1

suse/graphicsmagick-debuginfo<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/libgraphicsmagick3-config<1.3.42-150600.3.51.1

1.3.42-150600.3.51.1

suse/libgraphicsmagickwand-q16<2-1.3.42-150600.3.51.1

2-1.3.42-150600.3.51.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/GraphicsMagick to a version that resolves this vulnerability.
Fixed in 1.3.42-150600.3.51.1
Upgrade
Upgrade suse/GraphicsMagick-devel to a version that resolves this vulnerability.
Fixed in 1.3.42-150600.3.51.1
Upgrade
Upgrade suse/libGraphicsMagick-Q16 to a version that resolves this vulnerability.
Fixed in 3-debuginfo-1.3.42-150600.3.51.1
Upgrade
Upgrade suse/GraphicsMagick-debugsource to a version that resolves this vulnerability.
Fixed in 1.3.42-150600.3.51.1
Upgrade
Upgrade suse/perl-GraphicsMagick to a version that resolves this vulnerability.
Fixed in 1.3.42-150600.3.51.1
Upgrade
Upgrade suse/perl-GraphicsMagick-debuginfo to a version that resolves this vulnerability.
Fixed in 1.3.42-150600.3.51.1
Upgrade
Upgrade suse/libGraphicsMagick-Q16 to a version that resolves this vulnerability.
Fixed in 3-1.3.42-150600.3.51.1
Upgrade
Upgrade suse/libGraphicsMagickWand-Q16 to a version that resolves this vulnerability.
Fixed in 2-debuginfo-1.3.42-150600.3.51.1
Upgrade
Upgrade suse/GraphicsMagick-debuginfo to a version that resolves this vulnerability.
Fixed in 1.3.42-150600.3.51.1
Upgrade
Upgrade suse/libGraphicsMagick3-config to a version that resolves this vulnerability.
Fixed in 1.3.42-150600.3.51.1
Upgrade
Upgrade suse/libGraphicsMagickWand-Q16 to a version that resolves this vulnerability.
Fixed in 2-1.3.42-150600.3.51.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2026-5095
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-5095

Event History

Nov 4, 2026

Advisory Published

via OSV·08:18 AM

Data Sourced

via OSV·08:18 AM

DescriptionAffected Software

Advisory Published

via SUSE·08:18 AM

Data Sourced

via SUSE·08:18 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109964

Frequently Asked Questions

Which systems are affected by this issue?

The issue affects 32-bit systems using GraphicsMagick components covered by this update, including the GraphicsMagick libraries, tools, development packages, and Perl bindings listed in the advisory.

What would an attacker need to trigger the vulnerability?

An attacker would need to cause GraphicsMagick to process a PICT image. The provided information identifies the vulnerable component as the PICT decoder but does not specify a delivery vector or required privileges.

How can I determine whether I need this update?

Check whether the system is 32-bit and has any of the listed GraphicsMagick packages installed. Systems that do not process PICT images are not identified as unaffected by the advisory, but the vulnerable code is specifically the PICT decoder.

SUSE-SU-2026:5095-1: Security update for GraphicsMagick

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are affected by this issue?

What would an attacker need to trigger the vulnerability?

How can I determine whether I need this update?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected by this issue?

What would an attacker need to trigger the vulnerability?

How can I determine whether I need this update?