The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789467564 advisory.

  - ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation     inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget     and result in a denial of service. (CVE-2026-86420)

  - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL     image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and     cause a denial of service. (CVE-2026-86421)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789467167 advisory.

  - ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation     inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget     and result in a denial of service. (CVE-2026-86420)

  - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL     image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and     cause a denial of service. (CVE-2026-86421)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4691-1 advisory.

    - CVE-2026-86420: Denial of Service due to memory budget exhaustion (bsc#1279696).
    - CVE-2026-86421: Denial of Service via memory leak in MSL decoder (bsc#1279711).
    - CVE-2026-86423: Denial of service via heap-use-after-free in PerlMagick's GetList method (bsc#1279794).
    - CVE-2026-86425: Denial of Service due to heap-use-after-free vulnerability (bsc#1279797).
    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - CVE-2026-93590: failure to perform policy checks during buffer allocation for image pixels in the UHDR     encoder can       lead to denial of service (bsc#1281913).
    - CVE-2026-105083: security policy not applied when a user changes the DOCTYPE in the `policy.xml` file to     something       else that is valid xml (bsc#1284217).
    - CVE-2026-106564: a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing     the process to       crash (bsc#1284661).
    - CVE-2026-106565: a missing end-of-file check while reading bzip2-compressed image data can cause an     infinite loop       (bsc#1284662).
    - CVE-2026-106566: delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable,     allowing a       local privileged workflow to overwrite a file with random data (bsc#1284663).
    - CVE-2026-106567: a crafted PSD file can trigger an integer-conversion error in the PSD decoder, causing     an infinite       loop and DoS (bsc#1284664).
    - CVE-2026-106568: a crafted XMP profile embedded in an image can cause the profile parser to enter an     infinite loop       (bsc#1284665).
    - CVE-2026-106570: an unauthenticated adjacent-network client can repeatedly connect to the distributed     pixel cache       server and exhaust its available connections, causing a DoS (bsc#1284667).
    - CVE-2026-106571: a crafted local call to the GetVirtualPixels API can trigger an integer calculation     error and write       beyond a heap buffer, crashing the server process (bsc#1284668).
    - CVE-2026-106572: a missing recursion-depth check in the CALS decoder allows a crafted CALS image to     exhaust the call       stack and terminate the process (bsc#1284669).
    - CVE-2026-106573: a missing limit check in the MVG decoder allows a crafted MVG image to trigger an     excessively long-       running operation (bsc#1284671).
    - CVE-2026-106574: a client connected to the distributed pixel cache server can send crafted pixel data     that triggers a       heap buffer overwrite and crash the server (bsc#1284672).
    - CVE-2026-106575: a crafted Magick script can cause an opened file pointer to remain unclosed, allowing     repeated       processing to exhaust available file descriptors (bsc#1284673).
    - CVE-2026-106576: a crafted XMP profile can trigger excessive work while the parser determines a rational     value's       numerator and denominator, causing a DoS (bsc#1284674).
    - CVE-2026-106577: unescaped or untrimmed values can inject code into output generated by PostScript     coders       (bsc#1284675).
    - CVE-2026-106578: a crafted image can cause an invalid memory free in the MVG decoder and crash the     process       (bsc#1284677).
    - CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its     domain, potentially       allowing data prohibited by the policy to be read (bsc#1284678).
    - CVE-2026-107208: a crafted XMP profile can reach a recursion limit that is handled as a fatal condition     instead of an       ordinary exception, terminating the image-processing process (bsc#1284681).
    - CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a     resource limit       can cause a crash (bsc#1284682).
    - CVE-2026-107210: a crafted highly compressed MAT image can make the MAT decoder create temporary files     larger than the       configured security-policy limit (bsc#1284683).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation     inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget     and result in a denial of service. (CVE-2026-86420)

Note that Nessus relies on the presence of the package as reported by the vendor.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791541499 advisory.

  - ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation     inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget     and result in a denial of service. (CVE-2026-86420)

  - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL     image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and     cause a denial of service. (CVE-2026-86421)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4858 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4858-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     October 26, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : imagemagick     Version        : 8:6.9.11.60+dfsg-1.6+deb12u14     CVE ID         : CVE-2026-25971 CVE-2026-62343 CVE-2026-62946 CVE-2026-64685                      CVE-2026-86420 CVE-2026-86421 CVE-2026-86423 CVE-2026-86424                      CVE-2026-86425 CVE-2026-93586 CVE-2026-93587 CVE-2026-93588                      CVE-2026-93589 CVE-2026-102635 CVE-2026-106565 CVE-2026-106566                      CVE-2026-106567 CVE-2026-106568 CVE-2026-106570 CVE-2026-106571                      CVE-2026-106572 CVE-2026-106573 CVE-2026-106577 CVE-2026-106578                      CVE-2026-106579 CVE-2026-106580 CVE-2026-107208 CVE-2026-107209                      CVE-2026-107210 CVE-2026-109261     Debian Bug     : 1147176 1149974 1150224 1150337

    Multiple security vulnerabilities were discovered in imagemagick, a     software suite used for editing and manipulating digital images, which     could lead to denial of service, information disclosure or potentially     arbitrary code execution if malformed images are processed.

    Also note that this release fixes a regression where converting an SVG     with an embedded PNG data URI to PNG fails.

    For Debian 12 bookworm, these problems have been fixed in version     8:6.9.11.60+dfsg-1.6+deb12u14.

    We recommend that you upgrade your imagemagick packages.

    For the detailed security status of imagemagick please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/imagemagick

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789650963 advisory.

  - ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation     inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget     and result in a denial of service. (CVE-2026-86420)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fc4d0a5b-d0c6-11f1-bae2-3497f65b111b advisory.

    The ImageMagick project published security advisories for               issues fixed in releases 7.1.2-26 through 7.1.2-34.  They include               heap buffer overflows, use-after-free, out-of-bounds reads,               integer overflows, division by zero, memory leaks and security               policy bypasses in various coders and in the command-line               interface.  A crafted image file can crash the process, disclose               memory contents or circumvent the configured security policy.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
362257	CentOS Linux 8.5 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1789467564)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	medium
352373	CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789467167)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	medium
366747	SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:4691-1)	Nessus	SuSE Local Security Checks	2026/10/17	2026/10/22	medium
343545	Linux Distros Unpatched Vulnerability : CVE-2026-86420	Nessus	Misc.	2026/9/7	2026/11/10	medium
364433	AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791541499)	Nessus	Alma Linux Local Security Checks	2026/10/9	2026/10/9	medium
371989	Debian dla-4858 : imagemagick - security update	Nessus	Debian Local Security Checks	2026/10/26	2026/10/26	medium
352557	CentOS Linux 7 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (CENTOS7:CLSA-2026:1789650963)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	medium
372203	FreeBSD : ImageMagick7 -- multiple vulnerabilities (fc4d0a5b-d0c6-11f1-bae2-3497f65b111b)	Nessus	FreeBSD Local Security Checks	2026/10/26	2026/11/6	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

high