An update of the ImageMagick package has been released.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790182513 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Versions     prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The     issue stems from an off-by-one error that causes out-of-bounds memory access when processing format     strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
    (CVE-2025-53014)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the     issue. (CVE-2025-53019)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address     below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions     7.1.2-0 and 6.9.13-26 fix the issue. (CVE-2025-53101)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning     callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a     non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1. (CVE-2025-55160)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (:) to montage
    -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero     dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been     patched in versions 6.9.13-28 and 7.1.2-2. (CVE-2025-55212)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790182513 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Versions     prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The     issue stems from an off-by-one error that causes out-of-bounds memory access when processing format     strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
    (CVE-2025-53014)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the     issue. (CVE-2025-53019)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive     `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address     below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions     7.1.2-0 and 6.9.13-26 fix the issue. (CVE-2025-53101)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning     callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a     non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1. (CVE-2025-55160)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (:) to montage
    -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero     dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been     patched in versions 6.9.13-28 and 7.1.2-2. (CVE-2025-55212)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host has a version of ImageMagick installed that is prior to 6.9.13-44 and 7.x prior to 7.1.2-19. It is, therefore, affected by multiple vulnerabilities:

  - A heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing     a crafted image. (CVE-2026-33901)

  - Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed     recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures,     it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. (CVE-2026-33908)

  - A heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling index.
    (CVE-2026-40310)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Versions     below both 7.1.2-19 and 6.9.13-44, contain a heap out-of-bounds write in the JP2 encoder with when a user     specifies an invalid sampling index. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
    (CVE-2026-40310)

Note that Nessus relies on the presence of the package as reported by the vendor.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1777047310 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on     32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has     been fixed in versions 6.9.13-44 and 7.1.2-19. (CVE-2026-33900)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     below both 7.1.2-19 and 6.9.13-44, the -sample operation has an out of bounds read when an specific offset     is set through the `sample:offset` define that could lead to an out of bounds read. This issue has been     fixed in versions 6.9.13-44 and 7.1.2-19. (CVE-2026-33905)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     below both 7.1.2-19 and 6.9.13-44, an integer overflow in the despeckle operation causes a heap buffer     overflow on 32-bit builds that will result in an out of bounds write. This issue has been fixed in     versions 6.9.13-44 and 7.1.2-19. (CVE-2026-34238)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Versions     below both 7.1.2-19 and 6.9.13-44, contain a heap out-of-bounds write in the JP2 encoder with when a user     specifies an invalid sampling index. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
    (CVE-2026-40310)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Versions     below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when     reading and printing values from an invalid XMP profile. This issue has been fixed in versions 6.9.13-44     and 7.1.2-19. (CVE-2026-40311)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
334076	Photon OS 5.0: Imagemagick PHSA-2026-5.0-91-0830	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/2	high
361599	AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790182513)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/9	critical
361701	Rocky Linux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790182513)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/9	critical
306547	ImageMagick < 6.9.13-44 / 7.x < 7.1.2-19 Multiple Vulnerabilities	Nessus	Misc.	2026/4/15	2026/4/20	high
310894	Photon OS 4.0: Imagemagick PHSA-2026-4.0-1002	Nessus	PhotonOS Local Security Checks	2026/4/29	2026/11/2	high
311150	Photon OS 5.0: Imagemagick PHSA-2026-5.0-0830	Nessus	PhotonOS Local Security Checks	2026/4/30	2026/10/14	high
306418	Linux Distros Unpatched Vulnerability : CVE-2026-40310	Nessus	Misc.	2026/4/14	2026/10/21	medium
351629	CentOS Linux 7 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1777047310)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	high

检测

插件搜索

high

critical

critical

high

high

high

medium

high